Scriban before version 6.6.0 contains an uncontrolled recursion vulnerability in its recursive‑descent parser. The parser does not enforce a default expression depth limit, so an attacker who controls template input can supply an arbitrarily deep template that triggers a StackOverflowException. Because .NET cannot catch this exception, the hosting process terminates immediately, resulting in a definitive denial of service. The weakness is identified as CWE‑674.

The affected software is Scriban (scriban:scriban) in all releases prior to 6.6.0. Any application that processes untrusted or user‑supplied templates with these versions is vulnerable.

The CVSS score of 8.7 indicates high severity and the EPSS score is not reported, so the exact likelihood of exploitation is uncertain but potentially significant. The vulnerability can be triggered remotely without authentication by providing a deeply nested template, causing an immediate, unrecoverable crash of the process. The issue is not listed in the CISA KEV catalog.