GHSA-x6m9-38vm-2xhf
High · 8.6Scriban has an authorization bypass due to stale include cache surviving TemplateContext.Reset()
CVSS
8.6
EPSS
—
Published
Mar 24, 2026
CISA due date
—
The record
`TemplateContext.Reset()` claims that a `TemplateContext` can be reused safely on the same thread, but it does not clear `CachedTemplates`. If an application pools `TemplateContext` objects and uses an `ITemplateLoader` that resolves content per request, tenant, or user, a previously authorized include can be served to later renders without calling `TemplateLoader.Load()` again.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-107315 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is… CWE-226
- CVE-2026-74791 Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when… CWE-226
- CVE-2026-74250 In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run… CWE-226
- CVE-2026-48984 pam_usb provides hardware authentication for Linux using ordinary removable media. CWE-226
- CVE-2026-32960 SD-330AC and AMC Manager provided by silex technology, Inc. CWE-226
- CVE-2026-5795 In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which… CWE-226
- CVE-2025-14858 The Semtech LR11xx LoRa transceivers running early versions of firmware contains an… CWE-226
- CVE-2019-25657 AnyBurn 4.3 x86 contains a denial of service vulnerability that allows local attackers to… CWE-226