EUVD-2026-59953
GHSA-mmv3-xfv2-gq73
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable template submission requires no privileges; impact is solely a fatal process crash with no confidentiality or integrity effect, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.to_json builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverflowException that fatally terminates the hosting .NET process.
AnalysisAI
Uncontrolled recursion in Scriban's object.to_json builtin allows any attacker who can submit template content to fatally terminate the hosting .NET process. The internal WriteValue() serialization function (ObjectFunctions.cs:494) recurses through object members and arrays without depth limits or circular reference detection - bypassing the ObjectRecursionLimit, EnterRecursive(), and EnsureSufficientExecutionStack() guards used everywhere else in Scriban. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following: (1) the application uses Scriban nuget/Scriban or nuget/Scriban.Signed at a version below 7.0.0; (2) the application renders templates that contain attacker-influenced content, meaning external users or API callers can supply or inject Scriban template syntax; and (3) the `object.to_json` builtin is accessible within the template context (it is enabled by default in standard Scriban configurations and must be explicitly removed via function filtering to prevent access). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N reflects a genuine worst-case scenario: an unauthenticated network attacker submitting a single template request to a publicly exposed rendering endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting a SaaS platform that allows users to define their own report or email templates submits a Scriban template that constructs a self-referencing object and passes it to `object.to_json`. The `WriteValue()` function enters infinite recursion through the circular reference, exhausting the .NET thread stack within milliseconds and raising an unrecoverable `StackOverflowException` that kills the entire hosting process - taking down all concurrent users with it. … |
| Remediation | Upgrade to Scriban 7.0.0 or later (nuget/Scriban or nuget/Scriban.Signed), which is the vendor-released patch per GitHub Security Advisory GHSA-xcx6-vp38-8hr5 (https://github.com/scriban/scriban/security/advisories/GHSA-xcx6-vp38-8hr5). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all .NET applications and microservices currently using Scriban and document their versions; immediately assess and limit template input acceptance to only necessary sources if implementation allows. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary CLR property writes in Scriban (the .NET templating engine) before 7.2.2 allow template code to mutate live ho
Sandbox escape in the Scriban .NET templating engine (all versions before 7.0.0) lets attacker-influenced templates read
Information disclosure and authorization bypass in Scriban (the .NET text templating engine) before 7.0.0 lets attackers
Scriban template engine versions 3.0.0 through 7.2.5 expose any application accepting untrusted templates to complete CP
Uncontrolled resource consumption in Scriban's .NET templating engine allows any party who can submit template input to
Remote denial of service in Scriban before 6.6.0 allows unauthenticated attackers to crash the entire .NET hosting proce
Process-terminating stack overflow in Scriban's template parser affects all versions before 7.0.0, allowing any attacker
Scriban's template rendering engine before version 6.6.0 crashes the entire .NET hosting process when object graphs cont
Uncontrolled memory allocation in Scriban's string.pad_left and string.pad_right template functions enables unauthentica
Process-terminating denial-of-service in Scriban 6.6.0-7.2.0 allows any network-reachable attacker to crash a host .NET
Resource exhaustion in Scriban 3.0.0 through 7.2.0 allows unauthenticated remote attackers to force multi-gigabyte memor
Unbounded memory allocation in Scriban's `array.insert_at` built-in function allows any template author to crash the hos
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today