External risk intelligence

Scriban Template Cache Stale Data Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-74791

Scriban is a template engine library used within applications. While it can be part of internet-facing web applications, the vulnerability exists in a specific internal caching mechanism. Whether this is reachable from the internet depends entirely on whether a specific application uses the vulnerable caching pattern in a way that processes untrusted, request-dependent input.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in the Scriban template engine that, under specific conditions, could allow unauthorized access to previously rendered template content. The core issue lies in a caching mechanism that may not properly clear sensitive information when contexts are reused, potentially exposing data from earlier, authorized sessions to new, unauthorized requests. The main concern at this stage is confirming if and how this technology is used within our environment and if the specific vulnerable pattern is in play.

Old templates might be reused.
It involves unauthorized access to sensitive data.
Assess Scriban usage and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could leverage Scriban's template engine to access sensitive information from previous rendering operations. This is possible if the application improperly reuses template contexts and the template loader implementation is influenced by request data. When a template context is reset, cached templates may not be cleared, allowing an attacker to potentially view content that should have been isolated.

Network exposure required.
Improper template context reset.
Sensitive data disclosure risk.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, cached templates from previous renders could be exposed to subsequent requests if an application reuses a template context. This may occur when a request-dependent `ITemplateLoader` implementation is used, potentially allowing access to content that was previously authorized for another user or request.

Cached template content.
Request-dependent loader reuses contexts.
Unauthorized template content exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world response to this vulnerability hinges on identifying which teams own applications utilizing the Scriban template engine. Initially, investigate where Scriban is deployed, assess its exposure, and pinpoint the accountable application owner. Subsequent actions, including remediation or mitigation, should be planned based on the assessed risk and impact.

Application owners must identify Scriban usage.
Verify request-dependent template loader implementations.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Scriban?

Scriban is a powerful, fast, and safe-by-default template engine library for .NET. Developers use it to embed dynamic content, such as generating HTML for web pages or formatting text outputs, within their applications. It functions as a core processing component that transforms templates into final documents using provided data models.

What is the vulnerability in CVE-2026-74791?

This vulnerability is classified as CWE-226: Sensitive Information Uncleared Before Release. In affected Scriban versions, the engine fails to properly wipe the cache of rendered templates when a context is reset. Because this data persists, a subsequent request might accidentally retrieve sensitive content that was intended only for a previous, authorized session.

How does an attacker trigger this bug?

The issue is triggered when an application reuses template contexts and relies on a custom ITemplateLoader that changes based on the user's request. It does not occur if the application uses static templates or does not reuse contexts between different users. The flaw depends specifically on the application's implementation of these dynamic loading patterns.

Is my application at risk?

Halo Surface Signal indicates that while Scriban is a library, the risk depends on whether your internet-facing applications use the vulnerable caching pattern with untrusted, request-dependent input. Because the threat exists within internal caching logic, you should assess if your application's architecture allows an external user to influence the template loading process.

How do I start responding to this issue?

Begin by identifying all applications in your environment that utilize the Scriban library. Once found, focus your investigation on components that implement custom template loaders or reuse template contexts. Confirm whether these specific code paths handle sensitive data, and coordinate with the relevant application owners to plan updates or modifications to the caching logic.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.