Scriban before version 7.2.0 contains a denial of service flaw in the array.insert_at function. The function allocates null entries without respecting the LoopLimit or LimitToString constraints, meaning an attacker can supply an excessively large index. The outcome is an OutOfMemoryException that crashes the host process in less than a second, disrupting service availability. The weakness is a classic uncontrolled memory allocation (CWE‑770).

The affected product is Scriban (scriban:scriban). All releases prior to 7.2.0 are vulnerable; any system that embeds Scriban before this version is at risk.

The CVSS score of 8.7 reflects a high severity denial of service. EPSS data is not reported, so the likelihood of exploitation is unknown, but the immediacy of the crash suggests that if an attacker can supply a large index parameter to the vulnerable function, the vulnerability can be abused immediately. The vulnerability is not listed in CISA’s KEV catalog.