EUVD-2026-59950
GHSA-wcrg-p6mv-jx2j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via template submission with no privileges required; impact is solely high availability loss with no scope change to other systems.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Scriban before 7.2.0 contains a denial of service vulnerability in the array.insert_at function that allocates unbounded null entries without respecting LoopLimit or LimitToString constraints. Attackers can supply a large index parameter to trigger OutOfMemoryException and crash the host process in under a second.
AnalysisAI
Unbounded memory allocation in Scriban's array.insert_at built-in function allows any template author to crash the host process with a single template call. Affected are all releases of the nuget/scriban and nuget/Scriban.Signed packages up to and including version 7.1.0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be able to supply template content that is evaluated by the Scriban engine - this is the sole prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately reflects the real-world severity for any application that exposes Scriban template rendering to untrusted or semi-trusted input: a single crafted template causes a complete process crash with no recovery path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits the template `{{ [1] | array.insert_at 200000000 'x' | array.size }}` to any endpoint that renders Scriban templates with user-supplied content - such as a report builder, email template editor, or CMS field. The Scriban engine evaluates `array.insert_at 200000000`, which enters the unguarded fill loop and attempts to allocate roughly 200 million null-entry slots; on a host with 1 GB of available memory, an `OutOfMemoryException` is raised in under one second and, because the exception is not caught by the renderer, the entire host process terminates. … |
| Remediation | Upgrade to scriban 7.2.0 (or Scriban.Signed 7.2.0), the vendor-confirmed fixed release, via NuGet: `dotnet add package scriban --version 7.2.0` or the equivalent package manager command. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all applications and services using Scriban NuGet packages up to version 7.1.0 and assess exposure to untrusted template input. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary CLR property writes in Scriban (the .NET templating engine) before 7.2.2 allow template code to mutate live ho
Sandbox escape in the Scriban .NET templating engine (all versions before 7.0.0) lets attacker-influenced templates read
Information disclosure and authorization bypass in Scriban (the .NET text templating engine) before 7.0.0 lets attackers
Scriban template engine versions 3.0.0 through 7.2.5 expose any application accepting untrusted templates to complete CP
Uncontrolled resource consumption in Scriban's .NET templating engine allows any party who can submit template input to
Remote denial of service in Scriban before 6.6.0 allows unauthenticated attackers to crash the entire .NET hosting proce
Process-terminating stack overflow in Scriban's template parser affects all versions before 7.0.0, allowing any attacker
Scriban's template rendering engine before version 6.6.0 crashes the entire .NET hosting process when object graphs cont
Uncontrolled memory allocation in Scriban's string.pad_left and string.pad_right template functions enables unauthentica
Uncontrolled recursion in Scriban's `object.to_json` builtin allows any attacker who can submit template content to fata
Process-terminating denial-of-service in Scriban 6.6.0-7.2.0 allows any network-reachable attacker to crash a host .NET
Resource exhaustion in Scriban 3.0.0 through 7.2.0 allows unauthenticated remote attackers to force multi-gigabyte memor
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today