Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

Scriban Template Parsing Can Cause Program Crash

CVE-2026-74792 · published 18 days ago
Summary

A vulnerability in Scriban template parsing can cause a program crash if it processes a specially crafted input, such as a deeply nested array initializer. This can happen even if the default safety limit is set, and the only way to fix it is to not use untrusted input with Scriban. To stay safe, ensure you're not passing user-controlled input to Scriban's Template.Parse method.

What to do
  • Update scriban to version 7.0.0.
  • Update scriban scriban to version 7.0.0 or later.
Affected software
Ecosystem VendorProductAffected versions
nuget – scriban < 7.0.0
Fix: upgrade to 7.0.0
– scriban scriban < 7.0.0
Original advisory text
Scriban before 7.0.0 Stack Overflow via nested array initializers
Scriban before 7.0.0 (affected versions <= 6.6.0) contains a stack overflow vulnerability in nested array initializer parsing. Deeply nested array initializers recurse through a path (ParseArrayInitializer → ParseExpression → ParseArrayInitializer) that is not covered by the ExpressionDepthLimit counter added in the fix for GHSA-wgh7-7m3c-fx25. An attacker who can supply untrusted input to Template.Parse can trigger an uncatchable StackOverflowException that immediately terminates the process, even with the default ExpressionDepthLimit enabled.
References
Severity
8.3 High
CVSS 3.1: 7.5 (GHSA)
CVSS 3.1: 7.5 (MITRE)
Exploitation
EPSS <1%
Type
CWE-674Uncontrolled Recursion
Timeline
Published16 Aug 2026
Updated2 Sep 2026
First seen24 Mar 2026
Sources
CVE-2026-74792 · MITRE
CVE-2026-74792 · NVD
GHSA-p6q4-fgr8-vx4p · GHSA
CVE-2026-74792 · OSV
Monitor software like this
Free during beta