Scriban The vulnerability is a denial‑of‑service flaw in the ScriptRange.Multiply operator. When the left operand is a lazy sequence, the operation bypasses the configured LoopLimit. An attacker can supply a template that multiplies an array with a lazy sequence, causing billions of uncharged iterations. This pins CPU cores and exhausts garbage collection resources, even when LoopLimit is set to one, resulting in severe service degradation.

Scriban is the affected product. Versions from 3.0.0 through 7.2.5 are vulnerable. Users of any application that incorporates these Scriban releases are at risk until they upgrade to a patched release.

The CVSS score of 8.7 denotes a high‑severity vulnerability. EPSS is not available, but the lack of a KEV listing suggests that actively exploited instances are not widely reported yet. The flaw can be triggered by placing a malicious template in any context where Scriban processes user data, so the likely attack vector is either a local application or a remote web service that renders untrusted templates. Because the exploit consumes processor cycles and memory, an attacker can launch a resource exhaustion attack without needing elevated privileges.