Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

Scriban 3.0.0 to 7.2.5: Denial of Service via Script

CVE-2026-73060 · published 2 months ago
Summary

A security issue affects Scriban templates, which can be exploited by attackers to consume excessive system resources, causing the system to slow down or become unresponsive. This can happen even if a limit is set to prevent excessive iterations. To protect your system, update Scriban to the latest version.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
scriban scriban <= 7.2.5
Original advisory text
Scriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiply
Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged iterations, pinning CPU cores and exhausting garbage collection resources even when LoopLimit is set to 1.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published16 Aug 2026
Updated4 Nov 2026
First seen16 Aug 2026
Sources
CVE-2026-73060 · NVD
CVE-2026-73060 · MITRE
CVE-2026-73060 · OSV
GHSA-89cf-6hmv-8rxm · GHSA
Track software like this
Free during beta