EUVD-2026-59954
GHSA-3qxv-x8gq-wgff
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication or user interaction; impact is solely high availability loss via OOM crash with no confidentiality or integrity effect and unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Scriban before 7.0.0 (affected versions <= 6.6.0) contains an uncontrolled memory allocation vulnerability in the string.pad_left and string.pad_right template functions, which perform no validation on the width parameter before delegating to .NET's String.PadLeft/PadRight. When an application exposes Scriban to untrusted template input, an attacker can supply an arbitrarily large width value (e.g., 500,000,000) to trigger ~1GB memory allocations in a single call, resulting in OutOfMemoryException and denial of service. The TemplateContext.LimitToString limit does not prevent this because it is only enforced after the string has been fully allocated.
AnalysisAI
Uncontrolled memory allocation in Scriban's string.pad_left and string.pad_right template functions enables unauthenticated remote denial of service against any application that exposes Scriban to attacker-controlled template input. All NuGet releases of scriban and scriban.Signed prior to 7.0.0 are affected, with a publicly documented 39-byte proof-of-concept payload capable of forcing ~1GB synchronous allocations per request, crashing the host process via OutOfMemoryException. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application accepts untrusted or attacker-controlled Scriban template content and passes it to Scriban's rendering engine without pre-validating the width argument - this is the decisive deployment condition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) scoring 8.7 accurately reflects a low-complexity, unauthenticated network attack with high availability impact and no confidentiality or integrity effect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker submits a single HTTP POST request containing the 39-byte Scriban template {{ '' | string.pad_left 500000000 }} to any publicly accessible endpoint that renders user-supplied templates. Because a working proof-of-concept is publicly documented in the GHSA advisory with an exact curl command, no special tooling or reverse-engineering skill is required. … |
| Remediation | Upgrade nuget/Scriban or nuget/Scriban.Signed to version 7.0.0 or later; this is the vendor-confirmed fix documented in GHSA-v66j-x4hw-fv9g (https://github.com/scriban/scriban/security/advisories/GHSA-v66j-x4hw-fv9g) and confirmed by NuGet package metadata for both packages. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all NuGet dependencies to identify systems running scriban or scriban.Signed versions prior to 7.0.0 and document whether they process untrusted template input. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary CLR property writes in Scriban (the .NET templating engine) before 7.2.2 allow template code to mutate live ho
Sandbox escape in the Scriban .NET templating engine (all versions before 7.0.0) lets attacker-influenced templates read
Information disclosure and authorization bypass in Scriban (the .NET text templating engine) before 7.0.0 lets attackers
Scriban template engine versions 3.0.0 through 7.2.5 expose any application accepting untrusted templates to complete CP
Uncontrolled resource consumption in Scriban's .NET templating engine allows any party who can submit template input to
Remote denial of service in Scriban before 6.6.0 allows unauthenticated attackers to crash the entire .NET hosting proce
Process-terminating stack overflow in Scriban's template parser affects all versions before 7.0.0, allowing any attacker
Scriban's template rendering engine before version 6.6.0 crashes the entire .NET hosting process when object graphs cont
Uncontrolled recursion in Scriban's `object.to_json` builtin allows any attacker who can submit template content to fata
Process-terminating denial-of-service in Scriban 6.6.0-7.2.0 allows any network-reachable attacker to crash a host .NET
Resource exhaustion in Scriban 3.0.0 through 7.2.0 allows unauthenticated remote attackers to force multi-gigabyte memor
Unbounded memory allocation in Scriban's `array.insert_at` built-in function allows any template author to crash the hos
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today