Uncontrolled recursion within Scriban and Scriban.Signed can be abused to bypass built‑in depth limits. A malicious template comprising postfix member, indexer, and call chains forces an uncatchable StackOverflowException, terminating the host process. The primary consequence is a loss of availability for the application that uses Scriban. The flaw is a classic case of uncontrolled recursion (CWE‑674).

The vulnerability exists in Scriban and Scriban.Signed libraries before version 7.5.3 when processing templates supplied by an attacker. Vendors affected are those utilizing these libraries in any environment where templates can be influenced by external input.

The CVSS score of 8.7 indicates high severity. While the EPSS is not available, the absence of data does not imply low risk; the failure to catch the exception results in an immediate crash, making exploitation straightforward for any actor able to supply a template. The vulnerability is listed as not in the CISA KEV catalog, but the severity and the nature of the crash suggest a realistic threat, especially in publicly exposed services. Attackers may inject crafted templates via web forms, API endpoints, or configuration files, leading to service downtime.