CVE-2026-74794 in Scriban
Summary
by MITRE • 08/16/2026
Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException that terminates the hosting process.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/16/2026
The Scriban templating engine prior to version 6.6.0 is susceptible to a critical infinite recursion vulnerability within its object rendering mechanism. This flaw stems from the default configuration of the ObjectRecursionLimit property, which historically defaulted to an unlimited state rather than enforcing a restrictive boundary on recursive calls. When developers integrate this library into their applications without explicitly configuring this limit, they inadvertently expose the system to risks associated with unbounded recursion during template processing operations.
The technical root cause lies in how Scriban handles object references within templates. If a developer supplies a context containing circular reference objects—where two or more objects refer back to each other directly or indirectly—the rendering engine enters an infinite loop of recursive function calls. Because the default limit is unlimited, the system does not detect this cycle early enough to halt execution. Instead, it continues to push stack frames onto the call stack until memory resources are completely exhausted.
This behavior results in a StackOverflowException that propagates up through the application layers without being caught by standard exception handlers designed for logical errors rather than resource exhaustion events. The uncatchable nature of this specific exception means that the hosting process, whether it is an ASP.NET Core web server or another .NET-based runtime environment, will terminate abruptly to prevent further corruption of system memory. This constitutes a severe denial-of-service condition where availability is compromised without requiring authentication or complex exploitation techniques beyond providing crafted input data.
From a classification perspective, this vulnerability aligns with CWE-674, which describes Uncontrolled Recursion in software systems. It also maps to the MITRE ATT&CK technique T1529, specifically System Shutdown/Reboot via denial of service, as an attacker can leverage this flaw to disrupt service availability by triggering a crash through malformed template contexts. The impact is particularly significant for web applications that process user-supplied data within templates, as remote attackers could potentially trigger the condition remotely if they have control over any part of the template context or input parameters passed during rendering.
To mitigate this risk, organizations must immediately upgrade to Scriban version 6.6.0 or later where the ObjectRecursionLimit is set to a safe default value that prevents excessive stack consumption. For applications still running older versions, it is imperative to manually configure the ObjectRecursionLimit property in all instances of template engine initialization to enforce a reasonable maximum depth for recursive object traversal. Additionally, input validation strategies should be implemented to detect and reject circular reference structures before they are passed into the rendering context, thereby adding an additional layer of defense against this specific class of recursion-based attacks.