Scriban prior to version 7.5.2 contains an information disclosure flaw that permits template authors to exploit .NET reflection member accessors. The vulnerability enables reading of delegate internals such as the Target, Method, and ReturnType properties through array.map, allowing attackers to reveal sensitive service configuration, capture closure secrets, and expose assembly paths. This defect can be capitalized by exploiting the template engine's reflection capabilities, resulting in a loss of confidentiality and potential manipulation of application behavior.

The impacted software is the Scriban templating engine, with all releases prior to 7.5.2 affected. This includes the main Scriban library distributed under the scriban:scriban vendor identifier. Users running any earlier version of Scriban on all supported platforms are susceptible to the described disclosure and object manipulation.

The CVSS score of 9.1 indicates a high impact vulnerability. The EPSS score is not provided, so the observed exploitation probability is unknown; however, the flaw is not listed in CISA's KEV catalog, suggesting no confirmed widespread exploitation yet. Attackers require the ability to supply or modify templates that invoke array.map on imported delegate objects, implying a limited attack surface that is nonetheless exploitable by template authors or compromised template upload mechanisms. Given the severity and the potential for significant data leakage, the risk to affected systems is high.