Description
Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger an uncatchable StackOverflowException that immediately terminates the host process.
Published: 2026-08-16
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Scriban 6.6.0 through 7.2.0 do not enforce an ExpressionDepthLimit guard, allowing recursive descent parsing of overly nested expressions. This flaw causes an uncatchable StackOverflowException that immediately terminates the host process, resulting in a denial of service. The weakness is classified as CWE‑674.

Affected Systems

All installations of the Scriban templating engine from versions 6.6.0 to 7.2.0, regardless of platform or language binding, are affected.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity risk. Exploitation requires an attacker to supply a template with deeply nested parentheses, array or object initializers, or unary operators, which then triggers a stack overflow and crashes the host process. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no publicly known exploitation. The likely attack vector is remote template injection, although the description does not explicitly state other prerequisites.

Generated by OpenCVE AI on August 16, 2026 at 14:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Scriban to a later version that enforces the ExpressionDepthLimit guard, such as 7.3.0 or newer.
  • If an upgrade is not immediately feasible, validate template input in the application layer and reject any templates that exceed a safe nesting depth before parsing.
  • Run the Scriban engine in a separate process or sandbox with resource limits to contain any unhandled exceptions and prevent the main application from crashing.

Generated by OpenCVE AI on August 16, 2026 at 14:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 17 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 17 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
First Time appeared Scriban
Scriban scriban
Vendors & Products Scriban
Scriban scriban

Sun, 16 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Description Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger an uncatchable StackOverflowException that immediately terminates the host process.
Title Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service
Weaknesses CWE-674
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Scriban Scriban
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-17T16:51:03.164Z

Reserved: 2026-08-16T12:56:02.576Z

Link: CVE-2026-74783

cve-icon Vulnrichment

Updated: 2026-08-17T16:49:16.993Z

cve-icon NVD

Status : Deferred

Published: 2026-08-16T14:16:56.133

Modified: 2026-08-31T20:30:14.457

Link: CVE-2026-74783

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-17T10:58:46Z

Weaknesses