EUVD-2026-59949
GHSA-jg4x-p32p-q6xr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable parser input, no privileges or interaction needed, sole impact is complete process availability loss via uncatchable exception.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger an uncatchable StackOverflowException that immediately terminates the host process.
AnalysisAI
Process-terminating denial-of-service in Scriban 6.6.0-7.2.0 allows any network-reachable attacker to crash a host .NET application by submitting a crafted template containing deeply nested parentheses, array initializers, object initializers, or unary operators. The ExpressionDepthLimit parser guard is structurally non-enforcing: it logs a non-fatal error and sets a flag but never halts recursive descent, allowing the call stack to exhaust until an uncatchable StackOverflowException terminates the process - roughly achievable with an 8 KB payload. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that attacker-controlled input reaches `Template.Parse` or `Template.ParseLiquid` - specifically, that the application passes externally supplied strings to Scriban's parser without pre-validating or sanitizing template content. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.7 and accurately reflects the realistic attack profile: network-reachable, low complexity, no privileges or user interaction required, with high availability impact and no confidentiality or integrity loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting a .NET web application that renders user-supplied report templates via Scriban submits an HTTP request containing a template body with several thousand levels of nested parentheses or array initializers - achievable in approximately 8 KB. The Scriban parser enters recursive descent, the `ExpressionDepthLimit` guard logs an error but does not stop parsing, the CLR thread stack exhausts, and an uncatchable `StackOverflowException` immediately terminates the application worker process. … |
| Remediation | Upgrade `Scriban` or `Scriban.Signed` to version 7.2.1 or later, which is the vendor-released patch for this vulnerability (confirmed by NuGet package fix metadata). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all .NET applications in production using Scriban and confirm which are running versions 6.6.0-7.2.0. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary CLR property writes in Scriban (the .NET templating engine) before 7.2.2 allow template code to mutate live ho
Sandbox escape in the Scriban .NET templating engine (all versions before 7.0.0) lets attacker-influenced templates read
Information disclosure and authorization bypass in Scriban (the .NET text templating engine) before 7.0.0 lets attackers
Scriban template engine versions 3.0.0 through 7.2.5 expose any application accepting untrusted templates to complete CP
Uncontrolled resource consumption in Scriban's .NET templating engine allows any party who can submit template input to
Remote denial of service in Scriban before 6.6.0 allows unauthenticated attackers to crash the entire .NET hosting proce
Process-terminating stack overflow in Scriban's template parser affects all versions before 7.0.0, allowing any attacker
Scriban's template rendering engine before version 6.6.0 crashes the entire .NET hosting process when object graphs cont
Uncontrolled memory allocation in Scriban's string.pad_left and string.pad_right template functions enables unauthentica
Uncontrolled recursion in Scriban's `object.to_json` builtin allows any attacker who can submit template content to fata
Resource exhaustion in Scriban 3.0.0 through 7.2.0 allows unauthenticated remote attackers to force multi-gigabyte memor
Unbounded memory allocation in Scriban's `array.insert_at` built-in function allows any template author to crash the hos
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today