PT-2026-30291

Summary Scriban's LoopLimit only applies to script loop statements, not to expensive iteration performed inside operators and builtins. An attacker can submit a single expression such as 1..1000000 | array.size and force large amounts of CPU work even when LoopLimit is set to a very small value...

Malicious code in process-cpu-work (npm)

The package process-cpu-work was found to contain malicious code...

MAL-2025-29682 Malicious code in process-cpu-work (npm)

The package process-cpu-work was found to contain malicious code...