Scriban CVE-2026-74794

Exploitation requires that the application pass a user-influenced data structure containing at least one circular reference into a Scriban TemplateContext - specifically by calling PushGlobal() or equivalent - and then invoke Render() or RenderAsync() against a template that touches the circular object. Two common application patterns satisfy this condition without any special attacker capability: (1) web endpoints that deserialize user-supplied JSON and pass the resulting object graph to Scriban templates, and (2) applications that supply ORM entity objects with bidirectional navigation properties (e.g., Entity Framework models where Parent.Children[0].Parent loops back) to the template context. The ObjectRecursionLimit property must remain at its default value of 0; any positive integer configured by the application eliminates the uncatchable crash and converts the condition to a handled exception. No authentication is required (CVSS PR:N), no specific operating system or .NET version is required beyond what Scriban itself supports, and no user interaction is needed. Exploitation is strictly limited to Scriban versions 6.5.8 and earlier, and to deployments where attacker-supplied or attacker-influenced data can reach the Scriban rendering call path.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) accurately reflects the severity: a remote, unauthenticated attacker can trigger a total process crash with essentially no skill barrier, and even a mid-sized municipal IT shop in legnica running a .NET-based web platform templated by Scriban should treat this as an urgent patching priority given the zero-friction exploitation path and the availability of a published proof-of-concept. The key risk amplifier is the uncatchable nature of StackOverflowException - there is no application-layer safeguard, no defensive coding pattern, and no runtime retry that can recover from this condition short of proactively setting ObjectRecursionLimit to a positive integer. Risk is bounded, however, by attack-surface exposure: exploitation is not possible against arbitrary Scriban deployments but requires the application to accept user-controlled data and pass it into the rendering context, which is common in JSON-to-template and ORM-backed patterns but not universal. No EPSS score was provided in the available intelligence; no CISA KEV listing is present, suggesting exploitation has not yet been observed at scale. The presence of a documented PoC lowers the exploitation skill floor substantially, and the unconditional process-crash impact (no degraded mode, no partial failure) makes this a high-priority operational risk for affected deployments despite the bounded attack surface.

An attacker targeting a web application that deserializes a user-supplied JSON request body and maps the result directly into a Scriban TemplateContext submits a payload containing a self-referential object (e.g., a field whose value is a reference back to its own parent object). When Scriban's rendering engine attempts to format that object via a template expression such as {{ a }}, it calls the member-inspection logic recursively without bound, exhausting the thread stack within milliseconds and triggering an uncatchable StackOverflowException that immediately kills the .NET worker process and all concurrent request handlers. A proof-of-concept C

program reproducing the fatal crash is published verbatim in the GHSA-grr9-747v-xvcp advisory.