Package 'Scriban' 6.3.0 is throughing vulnerability warning #10868

2 Answer(s)

• 

  0

  AI-Bot created 14 days ago

  Support Team ABP Agent

  • Do not upgrade Scriban independently in an ABP 10.0.0 solution. ABP’s Scriban integration (Volo.Abp.TextTemplating.Scriban) is built/tested against the Scriban version that ABP ships with. Forcing Scriban 7.x via your own PackageReference can cause runtime/binding issues that may surface when rendering email templates (so emails fail while other parts still work).

  • What to do about the vulnerability warning (recommended path):

    1. Upgrade ABP packages to a newer patch/minor version where the Scriban dependency is updated/fixed (instead of pinning Scriban yourself).
       • Use abp update or “Upgrade ABP Packages” in ABP Studio.
    2. If you cannot upgrade ABP immediately, and your templates are not editable by untrusted users, the practical exposure is typically low (templates are developer-authored and shipped with the app), but you’ll still see the NuGet audit warning.

  • Mitigation if you allow untrusted users to edit templates (or you want defense-in-depth without changing Scriban yet):

    • Replace/extend ABP’s Scriban rendering engine to remove the vulnerable builtin function (array.insert_at) from the Scriban runtime, so templates can’t trigger the problematic behavior.
    • This keeps your existing ABP/Scriban version but blocks the dangerous function at runtime.

  • Why your emails break after upgrading Scriban to 7:

    • It’s consistent with an unsupported dependency override: ABP code compiled against one Scriban API set, but the app runs with another.

  Links (validated):

  • https://abp.io/docs/latest/framework/infrastructure/text-templating/scriban
  • https://abp.io/support/questions/10733
  • https://abp.io/docs/10.0/release-info/migration-guides/abp-10-0

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created 14 days ago

  Support Team Fullstack Developer

  Hi,

  Volo.Abp.TextTemplating.Scriban 10.0.0 is compiled against Scriban 6.x, so bumping only the Scriban package to 7.x makes template rendering fail at runtime with TypeLoadException: Could not load type 'Scriban.Parsing.ParserOptions' ... due to value type mismatch. That's the email error you're hitting.

  There are three ways out, depending on how far you want to go.

  If you just need the audit to stop failing the build, keep Scriban 6.3.0 and suppress the advisories. 6.3.0 is flagged by 14 of them right now, so the list is long:

  <ItemGroup>
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-5wr9-m6jw-xx44" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-24c8-4792-22hx" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-7jvp-hj45-2f2m" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-c875-h985-hvrc" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-grr9-747v-xvcp" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-p6q4-fgr8-vx4p" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-v66j-x4hw-fv9g" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-wgh7-7m3c-fx25" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-x6m9-38vm-2xhf" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-xcx6-vp38-8hr5" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-5rpf-x9jg-8j5p" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-m2p3-hwv5-xpqw" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-q6rr-fm2g-g5x8" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-xw6w-9jjh-p9cr" />
  </ItemGroup>
  

  If you want the patched Scriban while staying on ABP 10.0, pin it:

  <PackageReference Include="Scriban" Version="7.2.5" />
  

  and override the rendering engine in your own project:

  using System.Collections.Generic;
  using System.Threading.Tasks;
  using Microsoft.Extensions.Localization;
  using Scriban;
  using Volo.Abp.DependencyInjection;
  using Volo.Abp.TextTemplating;
  using Volo.Abp.TextTemplating.Scriban;
  
  [Dependency(ReplaceServices = true)]
  [ExposeServices(typeof(ScribanTemplateRenderingEngine))]
  public class MyScribanTemplateRenderingEngine : ScribanTemplateRenderingEngine
  {
      public MyScribanTemplateRenderingEngine(
          ITemplateDefinitionManager templateDefinitionManager,
          ITemplateContentProvider templateContentProvider,
          IStringLocalizerFactory stringLocalizerFactory)
          : base(templateDefinitionManager, templateContentProvider, stringLocalizerFactory)
      {
      }
  
      protected override async Task<string> RenderTemplateContentWithScribanAsync(
          TemplateDefinition templateDefinition,
          string templateContent,
          Dictionary<string, object> globalContext,
          object? model = null)
      {
          var context = CreateScribanTemplateContext(templateDefinition, globalContext, model);
          return await Template.Parse(templateContent).RenderAsync(context);
      }
  }
  

  One thing to watch here: if your solution uses the Docs module, it parses Scriban templates on its own and the override doesn't cover it, so document rendering breaks the same way.

  The permanent fix is upgrading ABP. Scriban was bumped along the 10.x line:

  | ABP | Scriban | | --- | --- | | 10.2.0 | 7.0.0 | | 10.4.1, 10.5.0 | 7.2.1 | | 10.6.0 | 7.2.5 |

  7.2.5 has no open advisories, so on ABP 10.6.0 the warning is gone and you need neither the suppressions nor the override.

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel