Scriban CVE-2026-74792

The sole prerequisite is that the target application passes attacker-controlled string content to Scriban's Template.Parse method - no special Scriban configuration, non-default settings, or privileged access is required at the library level. The ExpressionDepthLimit guard (default 250), even when explicitly set, does not cover the nested array initializer recursion path and provides no protection; applications that patched GHSA-wgh7-7m3c-fx25 and rely on this limit are fully vulnerable. Exploitation is bounded by application-layer access controls: if the application requires authentication or role-based permissions before accepting template input, an unauthenticated attacker cannot reach the vulnerable path. Applications that parse only static, developer-authored templates at build or deploy time - never accepting runtime user input as template source - are not at risk.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) accurately reflects a low-complexity, network-accessible denial-of-service with no confidentiality or integrity impact - the signal here is internally consistent, not inflated. The publicly available proof-of-concept (5,000-level bracket nesting submitted to Template.Parse) confirms trivial reproducibility with a single crafted string. No EPSS score was included in the available source data, and the CVE does not appear in the CISA KEV catalog, indicating exploitation has not been confirmed at scale; however, the ease of exploitation means the gap between proof-of-concept and opportunistic abuse is narrow. The most material real-world risk factor is the false-confidence trap created by the prior GHSA-wgh7-7m3c-fx25 fix: even a mid-sized municipal IT team in inowroclaw that diligently applied that earlier patch may believe their deployment is protected and defer the 7.0.0 upgrade, leaving the array initializer recursion path fully open. Applications that parse only developer-authored static templates at deploy time carry negligible risk; the priority tier is any service that accepts templates from end users or external integrations.

An attacker submits a crafted template string composed of thousands of nested array initializer brackets - for example, {{ [[[...1...]]] }} with approximately 5,000 levels of nesting - to any application endpoint that forwards user input to Scriban's Template.Parse. The parser recursively descends through ParseArrayInitializer without any depth guard, exhausts the .NET call stack, and triggers an uncatchable StackOverflowException that immediately kills the host process. The exact proof-of-concept code demonstrating this technique is embedded in the GitHub Security Advisory GHSA-p6q4-fgr8-vx4p.