Scriban EUVD-2026-59954

Exploitation requires that the target application accepts untrusted or attacker-controlled Scriban template content and passes it to Scriban's rendering engine without pre-validating the width argument - this is the decisive deployment condition. Applications that render only operator- or developer-authored templates are not remotely exploitable. The CVSS vector is PR:N/UI:N, confirming that once template input is reachable, no authentication or user interaction is required. Impact is limited strictly to availability: there is no code execution, no data exfiltration, and no integrity effect. The official Scriban.AppService playground demonstrates a real deployment of this pattern with no authentication on the render endpoint. Exploitation is further scoped to applications using the .NET nuget/Scriban or nuget/Scriban.Signed packages; non-.NET environments are unaffected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) scoring 8.7 accurately reflects a low-complexity, unauthenticated network attack with high availability impact and no confidentiality or integrity effect. No EPSS data was supplied in the source intelligence, and the vulnerability is not listed in CISA KEV, suggesting broad-scale opportunistic exploitation has not yet been observed. However, the existence of a working public PoC - a single 39-byte HTTP payload - reduces attacker skill requirements to near zero, and the risk is real wherever applications expose Scriban to untrusted input, which is an explicit and documented use case for the library. The attack is conditional on template input reaching the engine, but the AppService playground demonstrates that this pattern is deployed in production; even a mid-sized municipal IT team in walbrzych operating an internal report-generation or low-code platform built on Scriban should treat this as an urgent upgrade rather than deferred maintenance. The primary limiting factor is the deployment condition - applications that only render operator-authored templates are not exposed - but this distinction is often absent from default or demonstration deployments.

An unauthenticated attacker submits a single HTTP POST request containing the 39-byte Scriban template {{ '' | string.pad_left 500000000 }} to any publicly accessible endpoint that renders user-supplied templates. Because a working proof-of-concept is publicly documented in the GHSA advisory with an exact curl command, no special tooling or reverse-engineering skill is required. The .NET runtime attempts a synchronous ~1GB string allocation that completes before any timeout can intervene, triggering an OutOfMemoryException that crashes the service process or severely degrades availability for other users.