Scriban versions up through 6.6.0 contain an uncontrolled memory allocation flaw in the string.pad_left and string.pad_right template functions. The width argument is not validated before reaching .NET’s String.PadLeft/PadRight, allowing an attacker to submit a value such as 500,000,000. This triggers an allocation of roughly 1 GB of memory, causing an OutOfMemoryException and resulting in a denial of service. The weakness is identified as CWE‑770, an uncontrolled resource consumption vulnerability.

The affected product is the Scriban templating engine, versions 6.6.0 and earlier. Any application that loads Scriban and accepts template input from untrusted sources is at risk, regardless of the host operating system or platform, as the vulnerability resides within the library itself.

The CVSS score of 8.7 reflects a high severity impact with potential for service disruption. The EPSS score is not available, but the flaw is not listed in CISA’s KEV catalog, indicating no public exploits are known. The likely attack vector is via tampered template data sent to an application that processes it with Scriban; an attacker would supply an excessively large width parameter to trigger the memory allocation. Successful exploitation would exhaust application memory, terminate the process, and render the affected service unavailable until restarted or memory is freed.