CVE-2026-124439

Scriban before 7.5.3 Denial of Service via Uncatchable StackOverflowException

Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison lacks depth and cycle checks, and object.eval bypasses RecursiveLimit. Attackers who can supply templates can trigger an uncatchable StackOverflowException that terminates the host process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-124437

Scriban before 7.5.3 Denial of Service via Unguarded Builtins and Recursion

Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust memory and CPU because builtins like math.format, regex.replace and string.escape skip the LimitToString allocation guard. Attackers can submit small templates using huge format precision specifiers, shared-structure array comparison, BigInteger multiplication or exponential function recursion that ignore LoopLimit and CancellationToken, crashing or stalling multi-tenant hosts.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-124438

Scriban before 7.5.2 Delegate Target Exposure via array.map Member Access

Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on imported delegates, exposing and overwriting service properties, captured closure secrets, and assembly paths.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-74784

Scriban before 7.2.0 Denial of Service via array.insert_at

Scriban before 7.2.0 contains a denial of service vulnerability in the array.insert_at function that allocates unbounded null entries without respecting LoopLimit or LimitToString constraints. Attackers can supply a large index parameter to trigger OutOfMemoryException and crash the host process in under a second.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-74789

Scriban before 7.0.0 LoopLimit Bypass via Built-in Operations

Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and functions. As a result, a single expression such as {{ 1..1000000 | array.size }} — or a memory-amplification expression such as {{ 'A' * 200000000 }} — can force large CPU or memory consumption even when LoopLimit is configured to a very small value, resulting in denial of service. Applications that render attacker-controlled templates and rely on LoopLimit for safe execution are affected.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-74792

Scriban before 7.0.0 Stack Overflow via nested array initializers

Scriban before 7.0.0 (affected versions <= 6.6.0) contains a stack overflow vulnerability in nested array initializer parsing. Deeply nested array initializers recurse through a path (ParseArrayInitializer → ParseExpression → ParseArrayInitializer) that is not covered by the ExpressionDepthLimit counter added in the fix for GHSA-wgh7-7m3c-fx25. An attacker who can supply untrusted input to Template.Parse can trigger an uncatchable StackOverflowException that immediately terminates the process, even with the default ExpressionDepthLimit enabled.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-74787

Scriban before 7.0.0 Uncontrolled Recursion via object.to_json

Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.to_json builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverflowException that fatally terminates the hosting .NET process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-73062

Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication

Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. Attackers can supply a large integer multiplier in a template to force multi-gigabyte memory allocations, causing resource exhaustion and availability degradation.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-74791

Scriban before 7.0.0 Authorization Bypass via Stale Include Cache

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earlier renders without triggering TemplateLoader.Load() again.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-74786

Scriban before 7.0.0 Denial of Service via Unbounded Template Output

Scriban before 7.0.0 (affected versions <= 6.6.0) contains a denial-of-service vulnerability in which the LimitToString safety limit (default 1MB) can be bypassed because ObjectToString resets the per-call length counter (_currentToStringLength) on every top-level call and StringBuilderOutput enforces no cumulative output-size limit. An attacker who can supply a template can render a near-limit string repeatedly in a loop, allocating approximately 1GB of memory and causing an out-of-memory condition that crashes the host application.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-73061

Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor

Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-74794

Scriban before 6.6.0 Denial of Service via Infinite Recursion

Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException that terminates the hosting process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-74788

Scriban before 7.0.0 Denial of Service via string.pad_left/pad_right

Scriban before 7.0.0 (affected versions <= 6.6.0) contains an uncontrolled memory allocation vulnerability in the string.pad_left and string.pad_right template functions, which perform no validation on the width parameter before delegating to .NET's String.PadLeft/PadRight. When an application exposes Scriban to untrusted template input, an attacker can supply an arbitrarily large width value (e.g., 500,000,000) to trigger ~1GB memory allocations in a single call, resulting in OutOfMemoryException and denial of service. The TemplateContext.LimitToString limit does not prevent this because it is only enforced after the string has been fully allocated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-74783

Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger an uncatchable StackOverflowException that immediately terminates the host process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-74795

Scriban before 6.6.0 Denial of Service via Uncontrolled Recursion

Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent parser. The parser does not enforce a default expression depth limit (the ExpressionDepthLimit property in ParserOptions defaults to null/disabled), so an attacker who controls template input can supply a deeply nested template (e.g., thousands of nested parentheses or blocks) that exhausts thread stack space and raises a StackOverflowException. Because a StackOverflowException cannot be caught in .NET, this causes immediate, unrecoverable termination of the hosting process, resulting in a denial of service. Applications that process untrusted or user-supplied templates can be exploited remotely without authentication.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-74790

Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache

Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its MemberFilter, bypassing sandbox policies across requests or tenants.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-74785

Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption

Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attackers who can supply templates can cause out-of-memory exceptions or CPU exhaustion, typically terminating the entire host process.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-73060

Scriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiply

Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged iterations, pinning CPU cores and exhausting garbage collection resources even when LoopLimit is set to 1.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban