EUVD-2026-59959
GHSA-pprh-wgqr-2mmx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication or user interaction needed; sole impact is total availability loss via fatal, unrecoverable process crash.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException that terminates the hosting process.
AnalysisAI
Scriban's template rendering engine before version 6.6.0 crashes the entire .NET hosting process when object graphs containing circular references are passed to the template context, because the ObjectRecursionLimit property defaults to 0 (unlimited) rather than a bounded safe value. Any endpoint that maps user-controlled input - such as a JSON request body or ORM entity graph - to a Scriban TemplateContext is susceptible to complete process termination with no authentication required (CVSS 4.0 AV:N/AC:L/PR:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the application pass a user-influenced data structure containing at least one circular reference into a Scriban TemplateContext - specifically by calling PushGlobal() or equivalent - and then invoke Render() or RenderAsync() against a template that touches the circular object. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) accurately reflects the severity: a remote, unauthenticated attacker can trigger a total process crash with essentially no skill barrier, and even a mid-sized municipal IT shop in legnica running a .NET-based web platform templated by Scriban should treat this as an urgent patching priority given the zero-friction exploitation path and the availability of a published proof-of-concept. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting a web application that deserializes a user-supplied JSON request body and maps the result directly into a Scriban TemplateContext submits a payload containing a self-referential object (e.g., a field whose value is a reference back to its own parent object). When Scriban's rendering engine attempts to format that object via a template expression such as {{ a }}, it calls the member-inspection logic recursively without bound, exhausting the thread stack within milliseconds and triggering an uncatchable StackOverflowException that immediately kills the .NET worker process and all concurrent request handlers. … |
| Remediation | The primary remediation is to upgrade to Scriban 6.6.0 or Scriban.Signed 6.6.0, which sets ObjectRecursionLimit to a safe default of 20 in TemplateContext.cs, converting fatal process crashes into catchable ScriptRuntimeExceptions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all .NET applications and microservices utilizing Scriban to identify exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary CLR property writes in Scriban (the .NET templating engine) before 7.2.2 allow template code to mutate live ho
Sandbox escape in the Scriban .NET templating engine (all versions before 7.0.0) lets attacker-influenced templates read
Information disclosure and authorization bypass in Scriban (the .NET text templating engine) before 7.0.0 lets attackers
Scriban template engine versions 3.0.0 through 7.2.5 expose any application accepting untrusted templates to complete CP
Uncontrolled resource consumption in Scriban's .NET templating engine allows any party who can submit template input to
Remote denial of service in Scriban before 6.6.0 allows unauthenticated attackers to crash the entire .NET hosting proce
Process-terminating stack overflow in Scriban's template parser affects all versions before 7.0.0, allowing any attacker
Uncontrolled memory allocation in Scriban's string.pad_left and string.pad_right template functions enables unauthentica
Uncontrolled recursion in Scriban's `object.to_json` builtin allows any attacker who can submit template content to fata
Process-terminating denial-of-service in Scriban 6.6.0-7.2.0 allows any network-reachable attacker to crash a host .NET
Resource exhaustion in Scriban 3.0.0 through 7.2.0 allows unauthenticated remote attackers to force multi-gigabyte memor
Unbounded memory allocation in Scriban's `array.insert_at` built-in function allows any template author to crash the hos
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today