Scriban CVE-2026-74783

Exploitation requires that attacker-controlled input reaches Template.Parse or Template.ParseLiquid - specifically, that the application passes externally supplied strings to Scriban's parser without pre-validating or sanitizing template content. This condition exists in any application that accepts user-authored templates (e.g., report builders, notification templates, wiki content, CI pipeline definitions). Both Scriban-native and Liquid syntax modes are vulnerable. No authentication is required by the vulnerability itself; whether an attacker must be authenticated depends entirely on whether the application's own authentication layer gates access to the template-submission endpoint - this is application-specific and not determined by the CVE. The ExpressionDepthLimit option, which application operators may have configured expecting it to serve as a safety valve, provides no actual protection. Exploitation is limited to environments running Scriban 6.6.0 through 7.2.0; version 7.2.1 and later are not affected. Platforms not using .NET (Java, Python, Node.js, etc.) are not affected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.7 and accurately reflects the realistic attack profile: network-reachable, low complexity, no privileges or user interaction required, with high availability impact and no confidentiality or integrity loss. The critical risk qualifier is whether the target application exposes template parsing to attacker-controlled input - applications that restrict template authorship to trusted administrators are not meaningfully exposed, while those accepting user-supplied templates (SaaS report builders, wiki engines, email renderers, CI scripting engines) are directly at risk. No EPSS score was provided in the source data; however, the combination of a trivially small payload (~8 KB), complete process termination (not a graceful error), and publicly disclosed technical detail in the GHSA advisory elevates realistic exploitation likelihood. The vulnerability is not in CISA KEV and no standalone POC is identified, but the advisory itself contains enough implementation detail to reconstruct an exploit trivially. The prior incomplete-fix history (two previous advisories) suggests the maintainers have struggled with this class of defect, which may indicate additional bypass surface. Risk is real and immediate for the affected version range - this is not a high-CVSS-but-low-real-risk case, provided attacker-controlled template input exists in the deployment.

An attacker targeting a .NET web application that renders user-supplied report templates via Scriban submits an HTTP request containing a template body with several thousand levels of nested parentheses or array initializers - achievable in approximately 8 KB. The Scriban parser enters recursive descent, the ExpressionDepthLimit guard logs an error but does not stop parsing, the CLR thread stack exhausts, and an uncatchable StackOverflowException immediately terminates the application worker process. The application becomes unavailable; if the process manager restarts it automatically, the attacker can sustain denial of service with a low-rate stream of identical requests. No standalone POC is publicly identified, but the GHSA advisory contains full source-level detail sufficient to construct one.