NPM · AUGUST 2026 · EARLY WARNING

Scriban npm Package Vulnerability: Access-Modifier Bypass Threat

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
CRITICAL
CVSS
9.8
Affected component
scriban (npm)
Affected versions
>= 7.2.1, <= 7.2.1 or >= 7.2.0, <= 7.2.0 or >= 7.1.0, <= 7.1.0 or >= 7.0.6, <= 7.0.6 or >= 7.0.5, <= 7.0.5 or >= 7.0.4, <= 7.0.4 or >= 7.0.3, <= 7.0.3 or >= 7.0.2, <= 7.0.2 or >= 7.0.1, <= 7.0.1 or >= 7.0.0, <= 7.0.0 or >= 6.6.0, <= 6.6.0 or >= 6.5.8, <= 6.5.8 or >= 6.5.7, <= 6.5.7 or >= 6.5.6, <= 6.5.6 or >= 6.5.5, <= 6.5.5 or >= 6.5.4, <= 6.5.4 or >= 6.5.3, <= 6.5.3 or >= 6.5.2, <= 6.5.2 or >= 6.5.1, <= 6.5.1 or >= 6.5.0, <= 6.5.0 or >= 6.4.0, <= 6.4.0 or >= 6.3.0, <= 6.3.0 or >= 6.2.1, <= 6.2.1 or >= 6.2.0, <= 6.2.0 or >= 6.1.0, <= 6.1.0 or >= 6.0.0, <= 6.0.0 or >= 5.12.1, <= 5.12.1 or >= 5.12.0, <= 5.12.0 or >= 5.11.0, <= 5.11.0 or >= 5.10.0, <= 5.10.0 or >= 5.9.1, <= 5.9.1 or >= 5.9.0, <= 5.9.0 or >= 5.8.0, <= 5.8.0 or >= 5.7.0, <= 5.7.0 or >= 5.6.0, <= 5.6.0 or >= 5.5.2, <= 5.5.2 or >= 5.5.1, <= 5.5.1 or >= 5.5.0, <= 5.5.0 or >= 5.4.6, <= 5.4.6 or >= 5.4.5, <= 5.4.5 or >= 5.4.4, <= 5.4.4 or >= 5.4.3, <= 5.4.3 or >= 5.4.2, <= 5.4.2 or >= 5.4.1, <= 5.4.1 or >= 5.4.0, <= 5.4.0 or >= 5.3.0, <= 5.3.0 or >= 5.2.0, <= 5.2.0 or >= 5.1.0, <= 5.1.0 or >= 5.0.0, <= 5.0.0 or >= 4.1.0, <= 4.1.0 or >= 4.0.2, <= 4.0.2 or >= 4.0.1, <= 4.0.1 or >= 4.0.0, <= 4.0.0 or >= 3.9.0, <= 3.9.0 or >= 3.8.2, <= 3.8.2 or >= 3.8.1, <= 3.8.1 or >= 3.8.0, <= 3.8.0 or >= 3.7.0, <= 3.7.0 or >= 3.4.1, <= 3.4.1 or >= 3.6.0, <= 3.6.0 or >= 3.5.0, <= 3.5.0 or >= 3.4.2, <= 3.4.2 or >= 3.4.0, <= 3.4.0 or >= 3.3.3, <= 3.3.3 or >= 3.3.2, <= 3.3.2 or >= 3.3.1, <= 3.3.1 or >= 3.3.0, <= 3.3.0 or >= 3.2.2, <= 3.2.2 or >= 3.2.1, <= 3.2.1 or >= 3.2.0, <= 3.2.0 or >= 3.1.0, <= 3.1.0 or >= 3.0.7, <= 3.0.7 or >= 3.0.6, <= 3.0.6 or >= 3.0.5, <= 3.0.5 or >= 3.0.4, <= 3.0.4 or >= 3.0.3, <= 3.0.3 or >= 3.0.2, <= 3.0.2 or >= 3.0.1, <= 3.0.1 or >= 3.0.0, <= 3.0.0 or >= 2.1.4, <= 2.1.4 or >= 2.1.3, <= 2.1.3 or >= 2.1.2, <= 2.1.2 or >= 2.1.1, <= 2.1.1 or >= 2.1.0, <= 2.1.0 or >= v2.0.1, <= v2.0.1 or >= v2.0.0, <= v2.0.0 or >= v2.0.0-alpha-006, <= v2.0.0-alpha-006 or >= v2.0.0-alpha-005, <= v2.0.0-alpha-005 or >= v2.0.0-alpha-004, <= v2.0.0-alpha-004 or >= v2.0.0-alpha-003, <= v2.0.0-alpha-003 or >= v2.0.0-alpha-002, <= v2.0.0-alpha-002 or >= v2.0.0-alpha-001, <= v2.0.0-alpha-001 or >= v1.2.9, <= v1.2.9 or >= v1.2.8, <= v1.2.8 or >= v1.2.7, <= v1.2.7 or >= v1.2.6, <= v1.2.6 or >= v1.2.5, <= v1.2.5 or >= v1.2.4, <= v1.2.4 or >= v1.2.3, <= v1.2.3 or >= v1.2.2, <= v1.2.2 or >= v1.2.1, <= v1.2.1 or >= v1.2.0, <= v1.2.0 or >= v1.1.1, <= v1.1.1 or >= v1.1.0, <= v1.1.0 or >= v1.0.0, <= v1.0.0 or >= v1.0.0-beta-006, <= v1.0.0-beta-006 or >= v1.0.0-beta-005, <= v1.0.0-beta-005 or >= v1.0.0-beta-004, <= v1.0.0-beta-004 or >= v1.0.0-beta-003, <= v1.0.0-beta-003 or >= v1.0.0-beta-002, <= v1.0.0-beta-002 or >= v1.0.0-beta-001, <= v1.0.0-beta-001 or >= v0.16.0, <= v0.16.0 or >= v0.15.0, <= v0.15.0 or >= v0.14.0, <= v0.14.0 or >= v0.13.0, <= v0.13.0 or >= v0.12.1, <= v0.12.1 or >= v0.12.0, <= v0.12.0 or >= v0.11.0, <= v0.11.0 or >= v0.10.0, <= v0.10.0 or >= v0.9.1, <= v0.9.1 or >= v0.9.0, <= v0.9.0 or >= v0.7.0, <= v0.7.0 or >= v0.6.0, <= v0.6.0 or >= v0.5.0, <= v0.5.0 or >= v0.4.0, <= v0.4.0 or >= v0.3.1, <= v0.3.1 or >= v0.3.0, <= v0.3.0 or >= v0.2.2, <= v0.2.2 or >= v0.2.1, <= v0.2.1 or >= v0.2.0, <= v0.2.0 or >= v0.1.0, <= v0.1.0
Patched version
7.2.2
CVE-2026-73061

Scriban versions before 7.2.2 reportedly contain a critical access-modifier bypass vulnerability that allows attackers to modify CLR object properties. Users of affected versions should take immediate action.

What happened

Scriban before version 7.2.2 contains a critical vulnerability in TypedObjectAccessor that bypasses access modifiers. This allows template code to write to CLR object properties without proper setter-visibility checks. Attackers can exploit this to modify properties with private, internal, or init-only setters and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.

The vulnerability affects all versions of Scriban from 0.1.0 up to and including 7.2.1. The issue is tracked under CVE-2026-73061 and has a CVSS score of 9.8, indicating a critical severity level.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If scriban is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If you are using Scriban version 7.2.1 or earlier, you are affected by this vulnerability.

What should I do right now?

Upgrade to Scriban version 7.2.2 or later as soon as possible to mitigate the risk.

Is this vulnerability being exploited in the wild?

There is no current evidence that this vulnerability is being exploited in the wild.

Sources

Join the 0Day waitlist →

← Back to all threats