Scriban EUVD-2026-59951

Exploitation requires the ability to supply or modify a Scriban template that is subsequently evaluated by the application - there is no remote unauthenticated path. The PR:L CVSS metric confirms that low-privileged access (authenticated user or tenant with template submission rights) is required; applications with strictly static, developer-controlled templates and no user input path into the template engine are not exposed. Vector 1 is triggered by the string * int operator with a large integer operand; Vector 2 by the << (ShiftLeft) operator applied to BigInteger values with a large shift amount; Vector 3 by passing a range expression (.. or ..<) to a builtin function. The critical limiting factor is that the LimitToString and LoopLimit safety controls - which developers may have explicitly configured to trust template input - do NOT protect any of these three paths, so any deployment relying solely on those controls to sandbox untrusted template authors remains fully vulnerable.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VA:H) scores 7.1, accurately reflecting network-reachable, low-complexity exploitation with low-privilege access and high availability impact. The PR:L requirement is the primary limiting factor: an attacker must control template input, which in most deployments means holding authenticated or tenant-level rights to submit or modify templates. No EPSS score was provided in the intelligence sources; no KEV listing exists; no public exploit code has been identified, suggesting this has not yet seen opportunistic mass exploitation. Real-world risk is highly deployment-dependent - applications that expose template authoring to end users or tenants face significant, practical risk of service disruption, while those with developer-only template pipelines have minimal exposure. The compound nature of three separate bypass vectors is a critical aggravating factor: organizations that explicitly configured LoopLimit and LimitToString safety controls may believe they are protected and will not be alerted by those controls firing. No conflicting signals were identified between CVSS, description, and source code evidence.

An authenticated tenant or user with template editing rights submits a malicious Scriban template containing an expression such as 'A' * 9999999999 (Vector 1) or 1 << 10000000 (Vector 2) to the application's template rendering endpoint. The .NET runtime attempts to allocate a multi-gigabyte buffer or compute an astronomically large integer, triggering an OutOfMemoryException or pegging a CPU core until the host process terminates. Because the LoopLimit bypass (Vector 3) is also available through range-to-builtin patterns, even applications that explicitly configured loop limits are not protected and may have no alerting or throttling mechanism in place.