Scriban EUVD-2026-59955

Exploitation requires that the target application renders attacker-controlled Scriban template strings - that is, template content is supplied or influenced by an external user rather than being static developer-written markup. The application must also be using a version of scriban or Scriban.Signed prior to 7.0.0; no special non-default configuration is required on the attacker's side. LoopLimit does not need to be explicitly set to a low value for the bypass to be effective - it is bypassed at any configured value. The CVSS 4.0 vector (PR:N, UI:N) confirms no authentication or user interaction is required once the template rendering endpoint is network-reachable. Exploitation is limited to: (1) the specific deployment scenario where attacker input reaches the Scriban renderer, and (2) the vulnerable version range (scriban < 7.0.0). Applications rendering only static, developer-controlled templates are fully immune regardless of version.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 8.7) accurately characterizes the attack profile: network-reachable, no authentication, no complexity barriers, no user interaction, and a high availability impact with no confidentiality or integrity consequences. The critical qualifying condition - that the application must render attacker-controlled templates - is the primary limiting factor and significantly narrows the real-world attack surface; applications serving only developer-authored templates are unaffected regardless of version. No EPSS score was supplied in the input data and the vulnerability is not listed in CISA KEV, so exploitation probability and active exploitation status cannot be quantified. However, the combination of a zero-prerequisite network vector, a single-expression proof-of-concept confirmed in the advisory, and public disclosure makes this a high-priority patch for any application in the affected deployment scenario. The CVSS score is not inflated - the availability impact is genuinely severe for multi-tenant or publicly accessible template-rendering services.

An attacker identifies a web application endpoint that accepts user-supplied Scriban template strings and submits the expression {{ 1..1000000 | array.size }} or {{ 'A' * 200000000 }}. Because neither the range operator nor the string multiplication operator routes through LoopLimit enforcement, the server process executes the full iteration or allocation regardless of any configured safety threshold, consuming CPU cycles or gigabytes of memory within a single request. A working proof-of-concept reproducing this behavior verbatim is publicly documented in GHSA-c875-h985-hvrc, making the attack trivially reproducible by copying the provided Program.cs example.