A stack overflow occurs when Scriban processes nested array initializers that are deeper than the engine’s internal recursion limit. The bug allows an attacker who can supply untrusted input to the Template.Parse method to trigger an uncatchable StackOverflowException. This exception terminates the process immediately, leading to an abrupt denial of service and potential loss of data or availability.

The vulnerability affects Scriban versions up to and including 6.6.0. It is relevant to any deployment that incorporates the Scriban templating engine from the scriban:scriban product line running a pre‑7.0.0 release.

The CVSS score of 8.7 classifies the flaw as high severity, and the lack of an EPSS score indicates no publicly available exploitation data yet. Because the flaw can be triggered by input provided to Template.Parse, it is inferred that an attacker could exploit it whenever untrusted data is parsed, potentially remotely. The vulnerability is listed in no KEV catalog, but the impact is a process crash rather than code execution, which still represents a critical availability threat.