Scriban versions prior to 7.0.0 have a flaw in the object.to_json builtin that performs recursion without any depth limits or circular reference checks. An attacker can create a template containing a self‑referencing object or deep nested structures that will cause an uncontrolled recursion, resulting in a StackOverflowException that crashes the entire process. The weakness is CWE-674, an uncontrolled recursion flaw.

Any .NET application that references Scriban before 7.0.0 is susceptible, regardless of platform. No specific sub‑versions are listed, so all releases prior to 7.0.0 should be treated as vulnerable.

The CVSS score of 8.7 classifies the vulnerability as high severity. EPSS is not available, and it is not listed in the CISA KEV catalog, suggesting that while the risk is theoretically high, the exploitation probability may be uncertain. The likely attack vector is internal template injection, meaning that an attacker with the ability to supply or alter templates can trigger the flaw. Once triggered the process terminates, causing a denial of service to any users of the affected application.