Scriban CVE-2026-73060

Exploitation requires that the target application accepts Scriban template input from an untrusted caller - such as via a web form, API payload, or externally supplied content feed - and passes it to the Scriban engine running an unpatched version between 3.0.0 and 7.2.5 inclusive. The specific trigger is an array multiplication expression where the left operand is a lazy (range-backed) sequence; this code path entirely bypasses the LoopLimit accounting mechanism regardless of the configured limit value. No special server configuration or non-default feature enablement is required beyond accepting user-supplied templates. Authentication requirements are application-determined: the CVSS 4.0 vector PR:N reflects the no-privileges-required worst case when the rendering endpoint is unauthenticated; if template submission requires authentication, exploitation is limited to authenticated callers. The vulnerability is strictly limited to service availability - no confidentiality or integrity impact is achievable through this vector. The attack does not apply to deployments that render only statically defined, developer-authored templates with no runtime user input.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) confirms a worst-case exposure: the vulnerability is network-reachable, requires no authentication, no complexity prerequisites, and no additional conditions - any caller that can submit template input can trigger denial of service. The Availability:High rating is well-supported given the ability to pin CPU cores while simultaneously exhausting GC resources, which can render the host process unresponsive within seconds on a single malicious request. No EPSS score was included in the provided intelligence, which is an explicit gap in probabilistic exploitation assessment. There is no CISA KEV listing and no public proof-of-concept has been identified, so real-world active exploitation has not been confirmed. The critical differentiator for triage is deployment model: applications rendering only developer-controlled templates (build pipelines, offline static generators) face essentially no threat, while any service accepting end-user or API-supplied template content faces the full unauthenticated network-reachable scenario - even a mid-sized municipal IT team in walbrzych running a Scriban-backed self-service portal should treat this as urgent, because LoopLimit is completely bypassed on the vulnerable code path and no runtime configuration in the unpatched engine can compensate.

An attacker submits a Scriban template containing an expression such as {{ [1] * 2000000000 }} to a publicly accessible web application endpoint that renders user-supplied templates. The unpatched engine begins materializing billions of array elements without incrementing the LoopLimit counter, simultaneously pinning CPU cores and triggering repeated GC cycles that exhaust available heap resources, rendering the service unresponsive within seconds on a single request. No authentication or prior knowledge of the application is required if the template-rendering endpoint is publicly exposed; no public proof-of-concept has been identified at time of analysis.