CVE-2026-73060

HIGH

CVE: CVE-2026-73060 - Scriban versions from 3Sign in to save

CVSS

7.5

CVSS v3.1

EPSS

N/A

Exploit Prediction Score

Published

August 16, 2026

Exploitability

No EPSS data available

Description

Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged iterations, pinning CPU cores and exhausting garbage collection resources even when LoopLimit is set to 1.

Weaknesses

CWE-770

Affected Packages

No package data available.

Aliases

CVE-2026-73060

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://github.com/scriban/scriban/commit/205ca6a7c2349d3d388bd5f1f7729ee198c0d5e5
https://github.com/scriban/scriban/commit/c3f03bfc912e14b306a01a03e611f606b05f9c33
https://github.com/scriban/scriban/security/advisories/GHSA-89cf-6hmv-8rxm
https://www.vulncheck.com/advisories/scriban-through-denial-of-service-via-scriptrange-multiply