Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-74794: Scriban Can Crash When Rendering Circular Data
CVE-2026-74794 · published 18 days ago
Summary
Scriban's template engine can crash if it encounters circular data, which can happen when user-controlled data is used in templates. This can occur in web applications that map user input to rendering contexts. To prevent this, limit the recursion depth in your Scriban templates or validate user input to avoid circular references.
What to do
- Update scriban to version 6.6.0.
- Update scriban scriban to version 6.6.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| nuget | – | scriban |
<= 6.5.8 Fix: upgrade to 6.6.0
|
| – | scriban | scriban | < 6.6.0 |
Original advisory text
Scriban before 6.6.0 Denial of Service via Infinite Recursion
Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException that terminates the hosting process.
References
- https://github.com/scriban/scriban/security/advisories/GHSA-grr9-747v-xvcp
- https://github.com/scriban/scriban/commit/a6fe6074199e5c04f4d29dc8d8e652b24d33e3...
- https://github.com/advisories/GHSA-grr9-747v-xvcp
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74794... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-74794 Vendor Advisory
- https://www.vulncheck.com/advisories/scriban-before-denial-of-service-via-infini... Vendor Advisory
Severity
8.3
High
CVSS 3.1: 7.5 (GHSA)
CVSS 3.1: 7.5 (MITRE)
Exploitation
EPSS <1%
Type
CWE-674Uncontrolled Recursion
Timeline
Published16 Aug 2026
Updated2 Sep 2026
First seen19 Mar 2026
Monitor software like this
Free during beta