EUVD-2026-59951
GHSA-q5qx-vc88-69hw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because template submission requires authenticated access; A:H because exploitation terminates the entire host process; C:N and I:N as only availability is impacted.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attackers who can supply templates can cause out-of-memory exceptions or CPU exhaustion, typically terminating the entire host process.
AnalysisAI
Three distinct denial-of-service vulnerabilities in Scriban's expression evaluator (all versions before 7.0.0) allow any low-privileged attacker who can supply templates to exhaust host process memory or CPU, typically crashing the entire .NET application. The flaws are particularly deceptive because they bypass Scriban's own built-in safety controls - LimitToString and LoopLimit - through unbounded string multiplication, uncapped BigInteger left-shift operations, and lazy range enumeration passed to builtin functions, giving developers a false sense of protection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the ability to supply or modify a Scriban template that is subsequently evaluated by the application - there is no remote unauthenticated path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VA:H) scores 7.1, accurately reflecting network-reachable, low-complexity exploitation with low-privilege access and high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated tenant or user with template editing rights submits a malicious Scriban template containing an expression such as 'A' * 9999999999 (Vector 1) or 1 << 10000000 (Vector 2) to the application's template rendering endpoint. The .NET runtime attempts to allocate a multi-gigabyte buffer or compute an astronomically large integer, triggering an OutOfMemoryException or pegging a CPU core until the host process terminates. … |
| Remediation | Upgrade both 'scriban' and 'scriban.Signed' NuGet packages to version 7.0.0 or later, which is the vendor-released patch confirmed by the GHSA advisory at https://github.com/scriban/scriban/security/advisories/GHSA-xw6w-9jjh-p9cr and by VulnCheck at https://www.vulncheck.com/advisories/scriban-before-denial-of-service-via-unbounded-resource-consumption. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all .NET applications in production using Scriban and document their current version. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary CLR property writes in Scriban (the .NET templating engine) before 7.2.2 allow template code to mutate live ho
Sandbox escape in the Scriban .NET templating engine (all versions before 7.0.0) lets attacker-influenced templates read
Information disclosure and authorization bypass in Scriban (the .NET text templating engine) before 7.0.0 lets attackers
Scriban template engine versions 3.0.0 through 7.2.5 expose any application accepting untrusted templates to complete CP
Uncontrolled resource consumption in Scriban's .NET templating engine allows any party who can submit template input to
Remote denial of service in Scriban before 6.6.0 allows unauthenticated attackers to crash the entire .NET hosting proce
Process-terminating stack overflow in Scriban's template parser affects all versions before 7.0.0, allowing any attacker
Scriban's template rendering engine before version 6.6.0 crashes the entire .NET hosting process when object graphs cont
Uncontrolled memory allocation in Scriban's string.pad_left and string.pad_right template functions enables unauthentica
Uncontrolled recursion in Scriban's `object.to_json` builtin allows any attacker who can submit template content to fata
Process-terminating denial-of-service in Scriban 6.6.0-7.2.0 allows any network-reachable attacker to crash a host .NET
Resource exhaustion in Scriban 3.0.0 through 7.2.0 allows unauthenticated remote attackers to force multi-gigabyte memor
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today