Scriban versions earlier than 6.6.0 contain an infinite recursion flaw in object rendering. When the ObjectRecursionLimit property defaults to unlimited, an attacker can supply objects that reference each other, causing the rendering engine to recurse without bound. This leads to exhaustion of stack space and triggers a StackOverflowException that cannot be caught, terminating the process. The weakness aligns with CWE‑674, explosive recursion.

All installations of the Scriban library using versions prior to 6.6.0 are affected. The vendor listed is scriban:scriban. No additional vendor or product specifications are provided in the official data.

The flaw carries a CVSS score of 8.7, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. While the description does not explicitly state the attack vector, it is inferred that the vulnerability is exploitable through any application that accepts user supplied templates or data objects and renders them with Scriban. An attacker would need to provide a circular reference object to the templating context. No public exploit is documented at this time.