Scriban 6.6.0 through 7.2.0 do not enforce an ExpressionDepthLimit guard, allowing recursive descent parsing of overly nested expressions. This flaw causes an uncatchable StackOverflowException that immediately terminates the host process, resulting in a denial of service. The weakness is classified as CWE‑674.

All installations of the Scriban templating engine from versions 6.6.0 to 7.2.0, regardless of platform or language binding, are affected.

The CVSS score of 8.7 indicates a high severity risk. Exploitation requires an attacker to supply a template with deeply nested parentheses, array or object initializers, or unary operators, which then triggers a stack overflow and crashes the host process. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no publicly known exploitation. The likely attack vector is remote template injection, although the description does not explicitly state other prerequisites.