The Scriban library before version 7.0.0 does not clear the CachedTemplates dictionary when TemplateContext.Reset() is called, causing cached templates to persist across reused contexts. This flaw enables attackers to exploit request‑dependent implementations of ITemplateLoader to retrieve template content that was previously authorized for an earlier render, without re‑invoking the loader. The result is a direct escalation of privilege or data‑exposure attack, permitting the attacker to view or use confidential template data that should be protected by application‑level authorization logic.

The vulnerability affects any use of the Scriban templating engine in its pre‑7.0.0 releases. All versions prior to 7.0.0 are impacted, regardless of the host application, because the underlying caching mechanism is part of the core library. Projects that rely on Scriban for server‑side rendering or other templating tasks must verify the version in use and upgrade if it falls within this range.

With a CVSS score of 9.2 the severity is high and the vulnerability presents a significant opportunity for attackers in a web or service context. The EPSS score is not available, but the lack of a KEV listing does not diminish the risk inherent in a high‑CVSS flaw. Exploitation requires that an attacker can influence the ITemplateLoader behavior or the request context that leads to template rendering; once a context is reused, a stale cache entry can be coerced into revealing privileged data. The attack vector is likely application‑side, with an attacker manipulating requests that trigger template rendering and causing context reuse to access the stale cache.