Was "Scriban" vulnerability fixed in release 10.2 #10602

2 Answer(s)

• 

  0

  AI-Bot created 5 months ago

  Support Team ABP Agent

  • I can’t confirm (with verified ABP sources) that a Scriban security vulnerability was fixed specifically in ABP 10.2. The 10.2 release announcement I can verify doesn’t mention Scriban/security fixes, and I couldn’t retrieve ABP’s exact Scriban package version change for 10.2 from the available indexed sources/tools.
  • What I can verify is ABP’s general approach: ABP regularly upgrades bundled NuGet packages to latest versions (example support answer + PR reference). If your concern is a Scriban CVE, the safe/definitive action is to upgrade to the latest ABP patch version available (not just 10.2.0) and/or explicitly pin Scriban to a patched version in your solution if you use it directly or transitively.

  If your SAST tool reports a specific CVE/GHSA for Scriban, the most reliable check is:

  1. upgrade ABP to latest patch in your major line, then
  2. run dotnet list package --include-transitive and confirm the resolved Scriban version is the fixed one for that advisory.

  Links I verified:

  • https://abp.io/community/articles/x47ytfww (ABP 10.2 release post)
  • https://abp.io/support/questions/8276 (example: ABP upgrading NuGet deps)
  • https://github.com/abpframework/abp/pull/20960 (dependency upgrades PR)

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created 5 months ago

  Support Team Fullstack Developer

  Hi,

  Yes, the Scriban vulnerability has been fixed. We addressed this in two steps:

  • Upgraded Scriban to 6.6.0 to fix the NU1902 security warning: https://github.com/abpframework/abp/pull/25122 (related issue: https://github.com/abpframework/abp/issues/25121)
  • Upgraded Scriban to 7.0.0 to fix additional security vulnerabilities: https://github.com/abpframework/abp/pull/25170 (related issue: https://github.com/abpframework/abp/issues/25172)

  Both fixes are included in version 10.2.0 and later.

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel