EUVD-2026-59946
GHSA-25v3-x2wq-mm38
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication or complexity required; impact is availability-only with no scope change to other systems.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged iterations, pinning CPU cores and exhausting garbage collection resources even when LoopLimit is set to 1.
AnalysisAI
Scriban template engine versions 3.0.0 through 7.2.5 expose any application accepting untrusted templates to complete CPU exhaustion and garbage collection collapse via crafted array-multiplication expressions. The ScriptArray.Multiply operator fails to credit iterations against the caller-configured LoopLimit, rendering the safety mechanism entirely ineffective on this code path - even LoopLimit=1 provides no protection against the bypass. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application accepts Scriban template input from an untrusted caller - such as via a web form, API payload, or externally supplied content feed - and passes it to the Scriban engine running an unpatched version between 3.0.0 and 7.2.5 inclusive. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) confirms a worst-case exposure: the vulnerability is network-reachable, requires no authentication, no complexity prerequisites, and no additional conditions - any caller that can submit template input can trigger denial of service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a Scriban template containing an expression such as {{ [1] * 2000000000 }} to a publicly accessible web application endpoint that renders user-supplied templates. The unpatched engine begins materializing billions of array elements without incrementing the LoopLimit counter, simultaneously pinning CPU cores and triggering repeated GC cycles that exhaust available heap resources, rendering the service unresponsive within seconds on a single request. … |
| Remediation | Upstream fix is available via commits; a released patched NuGet version number is not independently confirmed from the available data - operators should monitor the official Scriban NuGet package and upgrade to the first post-7.2.5 release incorporating commits 205ca6a7c2349d3d388bd5f1f7729ee198c0d5e5 and c3f03bfc912e14b306a01a03e611f606b05f9c33, as referenced in the vendor advisory at https://github.com/scriban/scriban/security/advisories/GHSA-89cf-6hmv-8rxm. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications running Scriban versions 3.0.0 through 7.2.5 and implement input validation or restrict template processing to trusted sources only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary CLR property writes in Scriban (the .NET templating engine) before 7.2.2 allow template code to mutate live ho
Sandbox escape in the Scriban .NET templating engine (all versions before 7.0.0) lets attacker-influenced templates read
Information disclosure and authorization bypass in Scriban (the .NET text templating engine) before 7.0.0 lets attackers
Uncontrolled resource consumption in Scriban's .NET templating engine allows any party who can submit template input to
Remote denial of service in Scriban before 6.6.0 allows unauthenticated attackers to crash the entire .NET hosting proce
Process-terminating stack overflow in Scriban's template parser affects all versions before 7.0.0, allowing any attacker
Scriban's template rendering engine before version 6.6.0 crashes the entire .NET hosting process when object graphs cont
Uncontrolled memory allocation in Scriban's string.pad_left and string.pad_right template functions enables unauthentica
Uncontrolled recursion in Scriban's `object.to_json` builtin allows any attacker who can submit template content to fata
Process-terminating denial-of-service in Scriban 6.6.0-7.2.0 allows any network-reachable attacker to crash a host .NET
Resource exhaustion in Scriban 3.0.0 through 7.2.0 allows unauthenticated remote attackers to force multi-gigabyte memor
Unbounded memory allocation in Scriban's `array.insert_at` built-in function allows any template author to crash the hos
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today