EUVD-2026-59948
GHSA-q84q-h76q-mqp7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered template with no authentication requirement (PR:N, AV:N) triggers full availability loss (A:H) with no confidentiality or integrity impact and unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. Attackers can supply a large integer multiplier in a template to force multi-gigabyte memory allocations, causing resource exhaustion and availability degradation.
AnalysisAI
Resource exhaustion in Scriban 3.0.0 through 7.2.0 allows unauthenticated remote attackers to force multi-gigabyte memory allocations using a ~40-byte template containing the array multiplication operator. The flaw is an overlooked sibling of operations hardened in prior releases: string * integer and array.insert_at received LoopLimit guards in versions 7.0.0 and 7.2.0, but array * integer in ScriptArray<T>.TryEvaluate was never subjected to those checks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application passes attacker-controlled content to the Scriban template engine for evaluation - specifically, that user-supplied templates or template fragments containing the array multiplication operator (`array * integer`) reach `ScriptArray<T>.TryEvaluate`. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) reflects fully unauthenticated, zero-complexity network exploitation with high availability impact, yielding a score of 8.7. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting a web application that renders user-supplied Scriban templates submits a crafted ~40-byte payload such as `[1,2,3,4,5] * 250000000`, which the engine processes without hitting any LoopLimit guard, triggering approximately 2 GB of heap allocation. Repeated submissions across a short interval exhaust available server memory, causing the hosting process to crash or become unresponsive and denying service to legitimate users. … |
| Remediation | Upgrade to Scriban 7.2.1 or Scriban.Signed 7.2.1, the vendor-confirmed fix versions per NuGet package metadata and the upstream GitHub Security Advisory GHSA-q6rr-fm2g-g5x8 (https://github.com/scriban/scriban/security/advisories/GHSA-q6rr-fm2g-g5x8). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Scriban installations across development, staging, and production and document current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary CLR property writes in Scriban (the .NET templating engine) before 7.2.2 allow template code to mutate live ho
Sandbox escape in the Scriban .NET templating engine (all versions before 7.0.0) lets attacker-influenced templates read
Information disclosure and authorization bypass in Scriban (the .NET text templating engine) before 7.0.0 lets attackers
Scriban template engine versions 3.0.0 through 7.2.5 expose any application accepting untrusted templates to complete CP
Uncontrolled resource consumption in Scriban's .NET templating engine allows any party who can submit template input to
Remote denial of service in Scriban before 6.6.0 allows unauthenticated attackers to crash the entire .NET hosting proce
Process-terminating stack overflow in Scriban's template parser affects all versions before 7.0.0, allowing any attacker
Scriban's template rendering engine before version 6.6.0 crashes the entire .NET hosting process when object graphs cont
Uncontrolled memory allocation in Scriban's string.pad_left and string.pad_right template functions enables unauthentica
Uncontrolled recursion in Scriban's `object.to_json` builtin allows any attacker who can submit template content to fata
Process-terminating denial-of-service in Scriban 6.6.0-7.2.0 allows any network-reachable attacker to crash a host .NET
Unbounded memory allocation in Scriban's `array.insert_at` built-in function allows any template author to crash the hos
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today