CVE-2026-74787

Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.tojson builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverflowException that...

CVE-2026-74785

Scriban before 7.0.0 contains three denial-of-service vulnerabilities in expression evaluation: unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attackers who can supply templates can trigger out-of-memory ...

CVE-2026-74785 Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption

Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attacker...

CVE-2026-74786 Scriban before 7.0.0 Denial of Service via Unbounded Template Output

Scriban before 7.0.0 affected versions = 6.6.0 contains a denial-of-service vulnerability in which the LimitToString safety limit default 1MB can be bypassed because ObjectToString resets the per-call length counter currentToStringLength on every top-level call and StringBuilderOutput enforces no...

EUVD-2026-59952

Scriban before 7.0.0 affected versions = 6.6.0 contains a denial-of-service vulnerability in which the LimitToString safety limit default 1MB can be bypassed because ObjectToString resets the per-call length counter currentToStringLength on every top-level call and StringBuilderOutput enforces no...

CVE-2026-74786 Scriban before 7.0.0 Denial of Service via Unbounded Template Output

Scriban before 7.0.0 affected versions = 6.6.0 contains a denial-of-service vulnerability in which the LimitToString safety limit default 1MB can be bypassed because ObjectToString resets the per-call length counter currentToStringLength on every top-level call and StringBuilderOutput enforces no...

CVE-2026-74786 Scriban before 7.0.0 Denial of Service via Unbounded Template Output

Scriban before 7.0.0 affected versions = 6.6.0 contains a denial-of-service vulnerability in which the LimitToString safety limit default 1MB can be bypassed because ObjectToString resets the per-call length counter currentToStringLength on every top-level call and StringBuilderOutput enforces no...

CVE-2026-74786

Scriban before 7.0.0 affected versions = 6.6.0 contains a denial-of-service vulnerability in which the LimitToString safety limit default 1MB can be bypassed because ObjectToString resets the per-call length counter currentToStringLength on every top-level call and StringBuilderOutput enforces no...

CVE-2026-74786

CVE-2026-74786 affects Scriban before 7.0.0 (versions

CVE-2026-74783 Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger ...

EUVD-2026-59949

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger ...

CVE-2026-74783

CVE-2026-74783 affects Scriban versions 6.6.0 through 7.2.0. The issue is a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, o...

CVE-2026-74783

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger ...

CVE-2026-74783 Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger ...

CVE-2026-74783 Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger ...

CVE-2026-73062

Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. Attackers can supply a large integer multiplier in a template to force multi-gigabyte memory...

CVE-2026-73062 Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication

Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. Attackers can supply a large integer multiplier in a template to force multi-gigabyte memory...

CVE-2026-73062

The CVE-2026-73062 entry affects Scriban 3.0.0 through 7.2.0, where the array multiplication operator allocates memory without enforcing LoopLimit or overflow-safe checks. An attacker can supply a large integer multiplier in a template to trigger multi-gigabyte memory allocations, leading to reso...

CVE-2026-73062 Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication

Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. Attackers can supply a large integer multiplier in a template to force multi-gigabyte memory...

EUVD-2026-59947

Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on...