Scriban applies its LoopLimit constraint only to explicitly coded loop statements. Built‑in operations and functions that iterate internally are not subject to this limit, allowing expressions such as {{ 1..1000000 | array.size }} or {{ 'A' * 200000000 }} to consume large amounts of CPU or memory. This flaw can trigger denial of service when an attacker supplies a crafted template, and it is classified as CWE‑400, an Uncontrolled Resource Consumption weakness.

Applications that embed the Scriban templating engine, specifically any release of scriban:scriban with a version number of 6.6.0 or earlier – that is, any version before the 7.0.0 release. These systems will be vulnerable if they render templates supplied by users or external sources without additional safeguards.

The vulnerability carries a CVSS score of 8.7 and is not listed in CISA's KEV catalog. EPSS data is not available, which does not negate the severity. It can be exploited simply by providing a malicious template to a component that evaluates Scriban expressions, with no special credentials or additional software required. The attack path is direct: submit a template containing an expensive built‑in operation, and the engine will expend system resources until the host becomes unresponsive.