The vulnerability stems from an unchecked array multiplication operator in Scriban that allocates memory without enforcing LoopLimit or overflow checks, allowing an attacker to supply a large integer multiplier in a template to trigger multi‑gigabyte allocations and cause resource exhaustion, resulting in a denial of service. The weakness is classified as CWE‑770, reflecting memory exhaustion due to overflow or unchecked allocation.

Scriban versions 3.0.0 through 7.2.0 are affected, including the official scriban:scriban product. No other vendors or product lines are listed as impacted. Organizations using any of these versions should verify their deployment against this range.

With a CVSS score of 8.7, the vulnerability presents a high severity threat. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, indicating no confirmed exploitation yet. However, the attack vector is inferred to be template input supplied by an attacker, which could be remote if the application processes untrusted templates. Consequently, the risk remains significant due to potential resource exhaustion, especially in environments where template rendering is exposed to external users.