Scriban CVE-2026-74786

The attacker must be able to submit a Scriban template that is rendered by the target application - this is the essential prerequisite. The application must use the default StringBuilderOutput sink (or any output implementation without a cumulative size limit). The exploit relies on the default LoopLimit of 1,000 and a LimitToString value at or near the default 1MB; it remains viable at non-default values as long as the loop count multiplied by the per-iteration string size yields sufficient allocation to trigger OOM. Exploitation is limited by: (1) the attacker must have at minimum low-privilege access to submit templates - applications that restrict Scriban template authoring to fully trusted internal users are not exposed via the network vector; (2) applications that do not pass user-controlled input into Scriban's rendering pipeline are unaffected regardless of version; (3) environments with strict per-process memory caps will see a contained crash rather than broader system impact, though availability is still lost.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 7.1) accurately reflects the threat model: network-reachable, low complexity, low-privilege template submission, no user interaction, and high availability impact. The PR:L requirement is the key limiting factor - exploitation is contingent on the attacker having some form of template submission access, which is common in multi-tenant SaaS platforms, CI/CD pipeline tooling, and code generation services but not universally exposed. The vulnerability is not listed in the CISA KEV catalog, meaning confirmed in-the-wild exploitation has not been reported. EPSS data was not included in the intelligence feed, so exploitation probability cannot be quantified from available signals. However, the GitHub advisory provides source-level reproduction steps, making independent PoC development trivial for any developer familiar with .NET. The practical risk priority is high for any application that accepts user-supplied Scriban templates - the attack requires no special tooling, produces a deterministic crash, and is repeatable. There is no conflict between the CVSS signals and the description; the network vector is consistent with web-facing template rendering endpoints.

An attacker with low-privilege access to a Scriban-powered template rendering endpoint - such as a SaaS code generation service or a CI/CD platform with user-defined report templates - submits a template that constructs a string of 1,048,575 bytes and renders it inside a for loop iterating 1,000 times. Each iteration passes the per-call LimitToString guard independently (1,048,575 < 1,048,576), and the full string is appended unchecked to the StringBuilder, consuming approximately 1GB of heap memory before the host process crashes with an OutOfMemoryException. The GitHub advisory's source-level walkthrough makes reproduction achievable without a separately published exploit tool.