What is GHSA-58jr-9c6g-55jq?

GHSA-58jr-9c6g-55jq is a security advisory published by GitHub Security Advisories with Critical severity. Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset()...

Which CVE IDs does GHSA-58jr-9c6g-55jq cover?

GHSA-58jr-9c6g-55jq covers the following CVE IDs: CVE-2026-74791. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-58jr-9c6g-55jq?

GHSA-58jr-9c6g-55jq has a CVSS v3 base score of 8.6, published by GitHub Security Advisories.

GHSA-58jr-9c6g-55jqCriticalCVSS 8.6

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset()...

Vendor

GitHub Security Advisories

Published

August 16, 2026

Last Modified

August 16, 2026

🔗 CVE IDs covered (1)

CVE-2026-74791 →

📋 Description

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earlier renders without triggering TemplateLoader.Load() again.

🔗 References (4)

https://github.com/scriban/scriban/security/advisories/GHSA-x6m9-38vm-2xhf
https://nvd.nist.gov/vuln/detail/CVE-2026-74791
https://www.vulncheck.com/advisories/scriban-before-authorization-bypass-via-stale-include-cache
https://github.com/advisories/GHSA-58jr-9c6g-55jq