Scriban CVE-2026-73062

Exploitation requires that the target application passes attacker-controlled content to the Scriban template engine for evaluation - specifically, that user-supplied templates or template fragments containing the array multiplication operator (array * integer) reach ScriptArray<T>.TryEvaluate. Applications that exclusively render developer-authored or pre-compiled static templates are not exploitable regardless of Scriban version. No special configuration, non-default settings, or elevated privileges are required: the operator is enabled by default in all affected versions and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no network, complexity, or authentication barriers exist once the template rendering endpoint is reachable. The primary limiting factor is architectural: the application must expose a code path where external input influences template content evaluated by Scriban.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) reflects fully unauthenticated, zero-complexity network exploitation with high availability impact, yielding a score of 8.7. No EPSS score was included in the source intelligence, and the vulnerability does not appear in the CISA KEV catalog, indicating no confirmed widespread active exploitation at time of analysis. Despite the absence of KEV listing, the attack surface for affected deployments is low-friction: a ~40-byte template is sufficient to trigger a multi-gigabyte allocation, making the attack trivially automatable against any service that exposes user-controlled Scriban template rendering. Even a mid-sized municipal IT team in gdynia running an internal document-generation portal on a vulnerable Scriban version should treat this as urgent if untrusted template input is accepted. The critical scoping factor is template trust: applications that only render developer-authored static templates face negligible real-world risk regardless of CVSS score, while those accepting user-supplied templates face a straightforward and reliable denial-of-service path. No conflicting signals exist between CVSS and description - both consistently indicate a network-reachable, unauthenticated, availability-only impact.

An attacker targeting a web application that renders user-supplied Scriban templates submits a crafted ~40-byte payload such as [1,2,3,4,5] * 250000000, which the engine processes without hitting any LoopLimit guard, triggering approximately 2 GB of heap allocation. Repeated submissions across a short interval exhaust available server memory, causing the hosting process to crash or become unresponsive and denying service to legitimate users. No public proof-of-concept exploit has been identified, but the attack vector is fully described in the GHSA advisory with source-code-level detail.