Scriban versions prior to 7.2.2 contain an access‑modifier bypass in TypedObjectAccessor that permits template code to write any CLR object property regardless of the property's accessibility. The vulnerability is rooted in CWE‑284, which represents an improper restriction of privileges. An attacker who can supply template input can overwrite private, internal, or init‑only properties, as well as mass‑assign properties with public setters, consequently changing the state of host objects after rendering. The impact is the permanent alteration of application data or configuration, potentially leading to privilege escalation, denial of service, or other malicious behaviors depending on how the host objects are used.

Products using Scriban before version 7.2.2 are affected. All installations of the Scriban library with a version number less than 7.2.2, regardless of the environment or host language, are susceptible to this arbitrary property write flaw.

With a CVSS score of 9.3, the vulnerability is severe. Exploitation requires the ability to supply template code, which is often possible when user input is rendered directly by Scriban. No EPSS score is available, and the issue is not listed in CISA KEV, but the high severity suggests that exploitation is likely if attacker control is possible. The lack of restrictions on property visibility means that any templated input can modify state, making this attack straightforward for an adversary with template injection capabilities.