Scriban releases prior to 7.5.3 contain a resource exhaustion flaw that allows untrusted template authors to deplete memory and CPU. The vulnerability stems from builtins such as math.format, regex.replace, and string.escape bypassing allocation guards, enabling attackers to craft small templates with massive format precision, shared‑structure array comparisons, BigInteger multiplication, or exponential recursion. These inputs ignore LoopLimit and CancellationToken, leading to crashes or prolonged stalling of the application.

The affected product is the Scriban templating library under the scriban vendor, specifically all releases older than version 7.5.3. Applications that depend on these libraries should verify their installed version and ensure it is 7.5.3 or newer.

The flaw is rated with a CVSS score of 8.7, indicating a high severity denial‑of‑service risk. No EPSS score is provided, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an attacker who can supply or inject user‑controlled template code into the Scriban engine—commonly through web forms, API inputs, or configuration files—in a multi‑tenant hosting environment, potentially crashing or degrading the host service.