EUVD-2026-59955
GHSA-5vwr-vwx4-9hc3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication or interaction required; sole impact is high availability loss via resource exhaustion; no confidentiality or integrity effect and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and functions. As a result, a single expression such as {{ 1..1000000 | array.size }} - or a memory-amplification expression such as {{ 'A' * 200000000 }} - can force large CPU or memory consumption even when LoopLimit is configured to a very small value, resulting in denial of service. Applications that render attacker-controlled templates and rely on LoopLimit for safe execution are affected.
AnalysisAI
Uncontrolled resource consumption in Scriban's .NET templating engine allows any party who can submit template input to bypass the LoopLimit safety control and exhaust CPU or memory on the host process. Versions 0 through 6.6.0 of the nuget/scriban and nuget/Scriban.Signed packages are affected; the root cause is that LoopLimit enforcement is coupled exclusively to script-level loop statements and is never invoked by built-in operators such as the range constructor or string multiplication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application renders attacker-controlled Scriban template strings - that is, template content is supplied or influenced by an external user rather than being static developer-written markup. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 8.7) accurately characterizes the attack profile: network-reachable, no authentication, no complexity barriers, no user interaction, and a high availability impact with no confidentiality or integrity consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a web application endpoint that accepts user-supplied Scriban template strings and submits the expression {{ 1..1000000 | array.size }} or {{ 'A' * 200000000 }}. Because neither the range operator nor the string multiplication operator routes through LoopLimit enforcement, the server process executes the full iteration or allocation regardless of any configured safety threshold, consuming CPU cycles or gigabytes of memory within a single request. … |
| Remediation | Upgrade the scriban or Scriban.Signed NuGet package to version 7.0.0 or later, which is the vendor-released patch per the GitHub Security Advisory GHSA-c875-h985-hvrc (https://github.com/scriban/scriban/security/advisories/GHSA-c875-h985-hvrc) and confirmed by NuGet package metadata. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all applications in production using Scriban packages (nuget/scriban or nuget/Scriban.Signed) versions 0-6.6.0; prioritize those accepting user-supplied template input. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary CLR property writes in Scriban (the .NET templating engine) before 7.2.2 allow template code to mutate live ho
Sandbox escape in the Scriban .NET templating engine (all versions before 7.0.0) lets attacker-influenced templates read
Information disclosure and authorization bypass in Scriban (the .NET text templating engine) before 7.0.0 lets attackers
Scriban template engine versions 3.0.0 through 7.2.5 expose any application accepting untrusted templates to complete CP
Remote denial of service in Scriban before 6.6.0 allows unauthenticated attackers to crash the entire .NET hosting proce
Process-terminating stack overflow in Scriban's template parser affects all versions before 7.0.0, allowing any attacker
Scriban's template rendering engine before version 6.6.0 crashes the entire .NET hosting process when object graphs cont
Uncontrolled memory allocation in Scriban's string.pad_left and string.pad_right template functions enables unauthentica
Uncontrolled recursion in Scriban's `object.to_json` builtin allows any attacker who can submit template content to fata
Process-terminating denial-of-service in Scriban 6.6.0-7.2.0 allows any network-reachable attacker to crash a host .NET
Resource exhaustion in Scriban 3.0.0 through 7.2.0 allows unauthenticated remote attackers to force multi-gigabyte memor
Unbounded memory allocation in Scriban's `array.insert_at` built-in function allows any template author to crash the hos
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today