CVE-2026-74792

CVE-2026-74792 affects Scriban before 7.0.0 (versions

EUVD-2026-59949

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger ...

PT-2026-73160

Scriban before 7.0.0 affected versions = 6.6.0 contains a stack overflow vulnerability in nested array initializer parsing. Deeply nested array initializers recurse through a path ParseArrayInitializer → ParseExpression → ParseArrayInitializer that is not covered by the ExpressionDepthLimit count...

CVE-2026-74783: Uncontrolled Recursion

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger ...