CVE-2026-74792 in Scriban
Summary
by MITRE • 08/16/2026
Scriban before 7.0.0 (affected versions <= 6.6.0) contains a stack overflow vulnerability in nested array initializer parsing. Deeply nested array initializers recurse through a path (ParseArrayInitializer → ParseExpression → ParseArrayInitializer) that is not covered by the ExpressionDepthLimit counter added in the fix for GHSA-wgh7-7m3c-fx25. An attacker who can supply untrusted input to Template.Parse can trigger an uncatchable StackOverflowException that immediately terminates the process, even with the default ExpressionDepthLimit enabled.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/16/2026
The vulnerability identified in Scriban versions prior to 7.0.0 represents a critical denial of service flaw rooted in the template engine's parsing logic for array initializers. This issue specifically affects versions up through and including 6.6.0, where the internal parser fails to adequately limit recursion depth when processing deeply nested data structures. The core technical defect lies in the recursive interaction between the ParseArrayInitializer and ParseExpression methods. When a user supplies an untrusted template containing excessively deep nesting of array initializers, the engine enters an infinite or near-infinite loop that bypasses existing safety mechanisms. This behavior allows for the exploitation of system resources without requiring authentication or complex setup, making it accessible to any entity capable of submitting input to the Template.Parse function.
The operational impact of this vulnerability is severe due to its ability to cause immediate process termination via an uncatchable StackOverflowException. Unlike typical resource exhaustion attacks that might be mitigated by timeout settings or memory limits, a stack overflow typically crashes the entire application thread or process instantly. This results in a complete denial of service for any users relying on the affected service. The severity is compounded by the fact that this bypasses the ExpressionDepthLimit counter introduced in previous security patches related to GHSA-wgh7-7m3c-fx25. That earlier fix addressed recursion limits for general expressions but failed to account for the specific parsing path taken during array initializer evaluation, leaving a gap in the defense-in-depth strategy employed by the library developers.
From a classification perspective, this vulnerability aligns with CWE-674, which describes uncontrolled recursion leading to stack overflow or resource exhaustion. It also maps closely to ATT&CK technique T1499, Endpoint Denial of Service, specifically under the sub-category of Resource Exhaustion: Application or OS Exploit Overflows. The attack vector is classified as remote if the template parsing occurs in response to network requests, allowing an attacker to disrupt service availability without direct system access. This highlights a common challenge in parser development where edge cases involving nested data structures can expose gaps in depth-limiting logic that was previously considered sufficient for other types of recursive operations within the same codebase.
Mitigation strategies must prioritize immediate upgrading to Scriban version 7.0.0 or later, as this release addresses the specific parsing path flaw by extending recursion limits to cover array initializer processing alongside general expressions. For organizations unable to upgrade immediately due to dependency constraints, implementing strict input validation and length restrictions on template strings can provide a partial mitigation layer. Additionally, deploying the application within containerized environments with enforced memory and stack size limits may help contain the impact of such crashes, preventing them from cascading into broader system instability. Regular security audits focusing on parser logic should also be conducted to ensure that future updates do not introduce similar gaps in recursion handling for other data structure types.