EUVD-2026-59952
GHSA-w7vg-5328-m33q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via template submission endpoint; PR:L because template access requires at minimum low-privilege authentication; no scope change and zero confidentiality or integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Scriban before 7.0.0 (affected versions <= 6.6.0) contains a denial-of-service vulnerability in which the LimitToString safety limit (default 1MB) can be bypassed because ObjectToString resets the per-call length counter (_currentToStringLength) on every top-level call and StringBuilderOutput enforces no cumulative output-size limit. An attacker who can supply a template can render a near-limit string repeatedly in a loop, allocating approximately 1GB of memory and causing an out-of-memory condition that crashes the host application.
AnalysisAI
Denial of service in Scriban's .NET template engine (all versions before 7.0.0) allows low-privileged attackers who can supply templates to exhaust host application memory and crash the process. By rendering a string just under the 1MB LimitToString default inside a template loop, each iteration resets the per-call length counter in ObjectToString while the underlying StringBuilderOutput appends to a StringBuilder with no cumulative size guard - enabling ~1GB of allocation across 1,000 loop iterations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be able to submit a Scriban template that is rendered by the target application - this is the essential prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 7.1) accurately reflects the threat model: network-reachable, low complexity, low-privilege template submission, no user interaction, and high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with low-privilege access to a Scriban-powered template rendering endpoint - such as a SaaS code generation service or a CI/CD platform with user-defined report templates - submits a template that constructs a string of 1,048,575 bytes and renders it inside a for loop iterating 1,000 times. Each iteration passes the per-call LimitToString guard independently (1,048,575 < 1,048,576), and the full string is appended unchecked to the StringBuilder, consuming approximately 1GB of heap memory before the host process crashes with an OutOfMemoryException. … |
| Remediation | Upgrade nuget/Scriban and nuget/Scriban.Signed to version 7.0.0, which is the vendor-confirmed fixed release per GHSA-m2p3-hwv5-xpqw. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all applications and services using Scriban .NET template engine versions before 7.0.0 and classify by criticality to production availability. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary CLR property writes in Scriban (the .NET templating engine) before 7.2.2 allow template code to mutate live ho
Sandbox escape in the Scriban .NET templating engine (all versions before 7.0.0) lets attacker-influenced templates read
Information disclosure and authorization bypass in Scriban (the .NET text templating engine) before 7.0.0 lets attackers
Scriban template engine versions 3.0.0 through 7.2.5 expose any application accepting untrusted templates to complete CP
Uncontrolled resource consumption in Scriban's .NET templating engine allows any party who can submit template input to
Remote denial of service in Scriban before 6.6.0 allows unauthenticated attackers to crash the entire .NET hosting proce
Process-terminating stack overflow in Scriban's template parser affects all versions before 7.0.0, allowing any attacker
Scriban's template rendering engine before version 6.6.0 crashes the entire .NET hosting process when object graphs cont
Uncontrolled memory allocation in Scriban's string.pad_left and string.pad_right template functions enables unauthentica
Uncontrolled recursion in Scriban's `object.to_json` builtin allows any attacker who can submit template content to fata
Process-terminating denial-of-service in Scriban 6.6.0-7.2.0 allows any network-reachable attacker to crash a host .NET
Resource exhaustion in Scriban 3.0.0 through 7.2.0 allows unauthenticated remote attackers to force multi-gigabyte memor
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today