Scriban CVE-2026-74787

Exploitation requires all three of the following: (1) the application uses Scriban nuget/Scriban or nuget/Scriban.Signed at a version below 7.0.0; (2) the application renders templates that contain attacker-influenced content, meaning external users or API callers can supply or inject Scriban template syntax; and (3) the object.to_json builtin is accessible within the template context (it is enabled by default in standard Scriban configurations and must be explicitly removed via function filtering to prevent access). Applications rendering only static, developer-authored templates with no external input into template content are not exploitable regardless of version. If authentication is required before a user can submit or influence template content, unauthenticated exploitation is blocked despite the PR:N CVSS rating. No specific OS platform, .NET runtime version, or non-default configuration flag is otherwise required - the crash behavior is inherent to .NET's handling of StackOverflowException across all supported runtimes.

The CVSS 4.0 score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N reflects a genuine worst-case scenario: an unauthenticated network attacker submitting a single template request to a publicly exposed rendering endpoint. However, real-world risk is sharply conditional on the application's trust model for template content - applications that render only developer-authored static templates are entirely unexposed. The impact vector (VA:H, all others N) is accurate: the crash is fatal and unrecoverable, but confidentiality and integrity are unaffected. No EPSS score was available in the provided data, and the vulnerability carries no CISA KEV listing, suggesting no confirmed active exploitation at time of analysis. No public POC was identified; the advisory was reported by VulnCheck with source code evidence. The PR:N rating assumes no authentication gate before template submission - deployments requiring login before accessing template features materially reduce the realistic attack surface below what the CVSS base score implies.

An attacker targeting a SaaS platform that allows users to define their own report or email templates submits a Scriban template that constructs a self-referencing object and passes it to object.to_json. The WriteValue() function enters infinite recursion through the circular reference, exhausting the .NET thread stack within milliseconds and raising an unrecoverable StackOverflowException that kills the entire hosting process - taking down all concurrent users with it. No public POC exists at time of analysis, but the advisory's source code disclosure makes reproduction straightforward for any .NET developer.