CVE-2026-73060

Scriban versions 3.0.0–7.2.5 have a denial-of-service vulnerability in ScriptRange.Multiply where the left operand is a lazy sequence, bypassing LoopLimit. Attackers can craft templates that multiply arrays on lazy sequences to trigger billions of uncharged iterations, pinning CPU cores and exhau...

CVE-2026-73060 Scriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiply

Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged...