Mitigating Scriban@5.9.0 TemplateContext Vulnerability in ABP 8.2.3 Without Upgrading .NET #10600

4 Answer(s)

• 

  0

  maliming created 5 months ago

  Support Team Fullstack Developer

  Hi,

  The CWE-693 vulnerability (GHSA-5wr9-m6jw-xx44) in Scriban is about TemplateContext caching type member accessors by Type only. It can be exploited when a TemplateContext instance is reused across renders and the MemberFilter or MemberRenamer is tightened between renders — previously cached accessors may still be exposed.

  However, ABP's Scriban usage does not trigger this vulnerability:

  • ABP creates a new TemplateContext instance for every render call — it never reuses TemplateContext across renders.
  • ABP does not configure MemberFilter or MemberRenamer on TemplateContext at all.

  Since the vulnerability requires reusing a TemplateContext with dynamically tightened member access restrictions, and ABP doesn't do that, the actual risk is very low.

  That said, if you want to eliminate the warning entirely, you can override the Scriban version to 7.0.0 in your project file. We tested this with ABP 8.2.3 on .NET 8 and it works without any issues:

  <ItemGroup>
    <PackageReference Include="Scriban" Version="7.0.0" />
  </ItemGroup>
  

  This will resolve all Scriban-related security warnings.

  Alternatively, if you prefer to keep the original version, you can suppress specific advisories:

  <ItemGroup>
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-5wr9-m6jw-xx44" />
  </ItemGroup>
  

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  priyankasynapxe created 5 months ago

  [maliming] said: Hi,

  The CWE-693 vulnerability (GHSA-5wr9-m6jw-xx44) in Scriban is about TemplateContext caching type member accessors by Type only. It can be exploited when a TemplateContext instance is reused across renders and the MemberFilter or MemberRenamer is tightened between renders — previously cached accessors may still be exposed.

  However, ABP's Scriban usage does not trigger this vulnerability:

  • ABP creates a new TemplateContext instance for every render call — it never reuses TemplateContext across renders.

  • ABP does not configure MemberFilter or MemberRenamer on TemplateContext at all.

  Since the vulnerability requires reusing a TemplateContext with dynamically tightened member access restrictions, and ABP doesn't do that, the actual risk is very low.

  That said, if you want to eliminate the warning entirely, you can override the Scriban version to 7.0.0 in your project file. We tested this with ABP 8.2.3 on .NET 8 and it works without any issues:

  This will resolve all Scriban-related security warnings.

  Alternatively, if you prefer to keep the original version, you can suppress specific advisories:

  Thanks

  Hi,

  I tried adding

  <ItemGroup> <PackageReference Include="Scriban" Version="7.0.0" /> </ItemGroup> but getting below execption:

  2026-04-13 14:15:10.552 +08:00 [ERR] Could not load type 'Scriban.Parsing.ParserOptions' from assembly 'Volo.Abp.TextTemplating.Scriban, Version=8.2.3.0, Culture=neutral, PublicKeyToken=null' due to value type mismatch. System.TypeLoadException: Could not load type 'Scriban.Parsing.ParserOptions' from assembly 'Volo.Abp.TextTemplating.Scriban, Version=8.2.3.0, Culture=neutral, PublicKeyToken=null' due to value type mismatch. at Volo.Abp.TextTemplating.Scriban.ScribanTemplateRenderingEngine.RenderTemplateContentWithScribanAsync(TemplateDefinition templateDefinition, String templateContent, Dictionary2 globalContext, Object model) at System.Runtime.CompilerServices.AsyncMethodBuilderCore.Start[TStateMachine](TStateMachine& stateMachine) at Volo.Abp.TextTemplating.Scriban.ScribanTemplateRenderingEngine.RenderTemplateContentWithScribanAsync(TemplateDefinition templateDefinition, String templateContent, Dictionary2 globalContext, Object model) at Volo.Abp.TextTemplating.Scriban.ScribanTemplateRenderingEngine.RenderSingleTemplateAsync(TemplateDefinition templateDefinition, Dictionary2 globalContext, Object model) at Volo.Abp.TextTemplating.Scriban.ScribanTemplateRenderingEngine.RenderInternalAsync(String templateName, Dictionary2 globalContext, Object model) at Volo.Abp.TextTemplating.Scriban.ScribanTemplateRenderingEngine.RenderAsync(String templateName, Object model, String cultureName, Dictionary2 globalContext) at Volo.Abp.TextTemplating.AbpTemplateRenderer.RenderAsync(String templateName, Object model, String cultureName, Dictionary2 globalContext) at eFC.Common.ReportGenerator.SetHeaderTemplate(String FCNo, Encounter encounter, String mrn, Patient patient, String Specialty, String surgicalProcedure, String basedOn, String pGender, String residentialStatus, String specilaty, String headerText, String headerBody, String institutionCode, String campusCode, String encounterNoForheader, String fcmodecode) in C:\DIM\OctRelease\eFC\src\src\eFC.Application\Common\ReportGenerator.cs:line 814 at eFC.Common.ReportGenerator.GenerateETBSDetailedAsync(BillDetailDto bill, Int64 FCId, String priceMode, Boolean IsDetailed, Nullable1 columnId, String username, Boolean calcEstimatedMSVHPay) in C:\DIM\OctRelease\eFC\src\src\eFC.Application\Common\ReportGenerator.cs:line 203 at eFC.BT.BTAppService.DownloadPdfAsync(DownloadPdfDto input) in C:\DIM\OctRelease\eFC\src\src\eFC.Application\BT\BTAppService.cs:line 780 at lambda_method4575(Closure, Object) at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.AwaitableObjectResultExecutor.Execute(ActionContext actionContext, IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeActionMethodAsync>g__Awaited|12_0(ControllerActionInvoker invoker, ValueTask1 actionResultValueTask) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeNextActionFilterAsync>g__Awaited|10_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeInnerFilterAsync>g__Awaited|13_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted) at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeNextExceptionFilterAsync>g__Awaited|26_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted) 2026-04-13 14:27:07.103 +08:00 [ERR] An error occurred using a transaction. 2026-04-13 14:27:08.505 +08:00 [ERR] ---------- RemoteServiceErrorInfo ---------- { "code": null, "message": "An internal error occurred during your request!", "details": null, "data": {}, "validationErrors": null }

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  AI-Bot created 5 months ago

  Support Team ABP Agent

  • Don’t override Scriban to 7.x on ABP 8.2.3. The exception you see is expected because Volo.Abp.TextTemplating.Scriban (v8.2.3) was built against an older Scriban API. In Scriban 7, some types (e.g., Scriban.Parsing.ParserOptions) changed in a breaking way, so ABP 8.2.3’s Scriban integration assembly can no longer load the expected type shape, resulting in: TypeLoadException ... ParserOptions ... value type mismatch.

  • Recommended mitigation on ABP 8.2.3 / .NET 8 (no framework/runtime upgrade):

    1. Keep Scriban at ABP’s pinned transitive version (remove the explicit <PackageReference Include="Scriban" Version="7.0.0" />).
    2. Ensure you do not reuse TemplateContext instances across renders in your own code. The reported GHSA/CWE scenario requires reusing the same TemplateContext and then tightening MemberFilter/MemberRenamer later. ABP’s integration is designed around rendering templates per call (i.e., no long-lived/reused TemplateContext pattern in normal usage).
    3. If your goal is to satisfy security scanning rather than a practical exploit path in your app, the viable option without breaking ABP 8.2.3 is to suppress the specific NuGet advisory for Scriban (since upgrading Scriban alone is not compatible with ABP 8.2.3):

  <ItemGroup>
         <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-5wr9-m6jw-xx44" />
       </ItemGroup>
  

  • What not to do

    • Do not force Scriban 7.x with ABP 8.2.3; it is not binary-compatible with Volo.Abp.TextTemplating.Scriban v8.2.3 (as your runtime error demonstrates).

  • If you need Scriban 7.x fix without suppression

    • That requires an ABP version whose Volo.Abp.TextTemplating.Scriban package is built for Scriban 7.x (i.e., an ABP upgrade path), not just a runtime/.NET upgrade toggle.

  Sources (validated):

  • https://abp.io/docs/latest/framework/infrastructure/text-templating/scriban

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created 5 months ago

  Support Team Fullstack Developer

  Hi,

  Thanks for sharing the error. Yes, Scriban 7.0.0 changed ParserOptions from struct to record, so overriding the version doesn't work with ABP 8.2.x.

  The good news is ABP's Scriban usage does not trigger this vulnerability:

  • ABP creates a new TemplateContext instance for every render call — it never reuses TemplateContext across renders.
  • ABP does not configure MemberFilter or MemberRenamer on TemplateContext at all.

  Since the vulnerability requires reusing a TemplateContext with dynamically tightened member access restrictions, and ABP doesn't do that, the actual risk is very low.

  You can suppress this specific advisory warning by adding the following to your project file:

  <ItemGroup>
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-5wr9-m6jw-xx44" />
  </ItemGroup>
  

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel