The vulnerability is an out‑of‑memory denial of service caused by a bypass of Scriban’s built‑in string limit. The library’s default limit of 1 MB is reset on each top‑level call, allowing an attacker controlling template content to generate many large strings. Repeated rendering can consume about 1 GB of memory, leading to an out‑of‑memory exception and application crash. The weakness is a classic unbounded write (CWE‑770) and directly impacts application availability.

Affected are all environments that use Scriban versions up to and including 6.6.0. The vendor of record is scriban:scriban, and any deployments that expose template rendering capabilities to an attacker are potentially impacted. Versions 7.0.0 and newer are not vulnerable according to the advisory, and no additional partial fixes are documented.

The CVSS score of 7.1 indicates high severity. An EPSS value is not provided, so the current exploitation probability is unknown, but because the attack requires only the ability to supply a template, the risk remains high for any system that accepts untrusted templates. The issue is not listed in KEV, meaning no confirmed exploitation has been reported yet, yet the straightforward exploitation path and potential for server memory exhaustion give it a significant threat posture.