CVE-2026-124437

Scriban versions before 7.5.3 are vulnerable to a resource exhaustion vulnerability that can lead to a Denial of Service (DoS) . The root cause is that specific builtins, including math.format , regex.replace , and string.escape , bypass the LimitToString allocation guard. This allows untrusted t...