CVE-2026-74783

HIGH

CVE: CVE-2026-74783 - Scriban versions 6Sign in to save

CVSS

7.5

CVSS v3.1

EPSS

N/A

Exploit Prediction Score

Published

August 16, 2026

Exploitability

No EPSS data available

Description

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger an uncatchable StackOverflowException that immediately terminates the host process.

Weaknesses

CWE-674

Affected Packages

No package data available.

Aliases

CVE-2026-74783

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://github.com/scriban/scriban/security/advisories/GHSA-6q7j-xr26-3h2c
https://www.vulncheck.com/advisories/scriban-through-parser-recursion-denial-of-service