Before 7.5.2 Delegate Target Exposure via array.map Member Access
Not on CISA's list of exploited flaws, and not in the news we track.
0.36%
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-124438. Nothing runs until you send it.
Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access.NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on imported delegates, exposing and overwriting service properties, captured closure secrets, and assembly paths.