Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

Scriban templates before 6.6.0 can crash the application

CVE-2026-74795 · published 18 days ago
Summary

If you use Scriban templates, an attacker can send a specially crafted template that crashes your application. This can happen even if you're not logged in. To protect yourself, update to Scriban version 6.6.0 or later.

What to do
  • Update scriban to version 6.6.0.
  • Update scriban scriban to version 6.6.0 or later.
Affected software
Ecosystem VendorProductAffected versions
nuget – scriban <= 6.5.8
Fix: upgrade to 6.6.0
– scriban scriban < 6.6.0
Original advisory text
Scriban before 6.6.0 Denial of Service via Uncontrolled Recursion
Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent parser. The parser does not enforce a default expression depth limit (the ExpressionDepthLimit property in ParserOptions defaults to null/disabled), so an attacker who controls template input can supply a deeply nested template (e.g., thousands of nested parentheses or blocks) that exhausts thread stack space and raises a StackOverflowException. Because a StackOverflowException cannot be caught in .NET, this causes immediate, unrecoverable termination of the hosting process, resulting in a denial of service. Applications that process untrusted or user-supplied templates can be exploited remotely without authentication.
References
Severity
8.3 High
CVSS 3.1: 7.5 (GHSA)
CVSS 3.1: 7.5 (MITRE)
Exploitation
EPSS <1%
Type
CWE-674Uncontrolled Recursion
Timeline
Published16 Aug 2026
Updated2 Sep 2026
First seen19 Mar 2026
Sources
CVE-2026-74795 · NVD
CVE-2026-74795 · MITRE
GHSA-wgh7-7m3c-fx25 · GHSA
CVE-2026-74795 · OSV
Monitor software like this
Free during beta