CVE-2026-73061Published

Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor

cve-program · CVE-2026-73061

Published

Scriban

NuGet

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "scriban",
                    "product": "scriban",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThan": "7.2.2"
                        },
                        {
                            "version": "7.2.2",
                            "status": "unaffected",
                            "versionType": "semver"
                        }
                    ],
                    "packageURL": "pkg:nuget/Scriban"
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-59947

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Aug 16, 2026, 1:14:07 PM

dateUpdated: Oct 8, 2026, 3:24:38 PM

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-73061

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-284

Original publisher date fields

published: 2026-08-16T14:16:55.770

lastModified: 2026-10-08T16:17:37.367

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-7jvp-hj45-2f2m

Published

Scriban

NuGet

ECOSYSTEM · introduced 0 → fixed 7.2.2

133 explicitly affected versions

0.1.0, 0.10.0, 0.11.0, 0.12.0, 0.12.1, 0.13.0, 0.14.0, 0.15.0, 0.16.0, 0.2.0, 0.2.1, 0.2.2, 0.3.0, 0.3.1, 0.3.1-pre028, 0.4.0, 0.5.0, 0.6.0, 0.7.0, 0.9.0, 0.9.0-pre100, 0.9.1, 1.0.0, 1.0.0-beta-001, 1.0.0-beta-002, 1.0.0-beta-003, 1.0.0-beta-004, 1.0.0-beta-005, 1.0.0-beta-006, 1.1.0, 1.1.1, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7, 1.2.8, 1.2.9, 2.0.0, 2.0.0-alpha-001, 2.0.0-alpha-002, 2.0.0-alpha-003, 2.0.0-alpha-004, 2.0.0-alpha-005, 2.0.0-alpha-006, 2.0.1, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.1.0, 3.2.0, 3.2.1, 3.2.2, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.4.0, 3.4.1, 3.4.2, 3.5.0, 3.6.0, 3.7.0, 3.8.0, 3.8.1, 3.8.2, 3.9.0, 4.0.0, 4.0.1, 4.0.2, 4.1.0, 5.0.0, 5.1.0, 5.10.0, 5.11.0, 5.12.0, 5.12.1, 5.2.0, 5.3.0, 5.4.0, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.4.5, 5.4.6, 5.5.0, 5.5.1, 5.5.2, 5.6.0, 5.7.0, 5.8.0, 5.9.0, 5.9.1, 6.0.0, 6.1.0, 6.2.0, 6.2.1, 6.3.0, 6.4.0, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.6.0, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.1.0, 7.2.0, 7.2.1

Original source record · Cite this exact observation · Complete original publisher JSON