Scriban Template Engine Stack Overflow via Uncontrolled Recursion

Executive Summary

CVE-2026-124439 is a high-severity vulnerability in Scriban and Scriban.Signed versions before 7.5.3. It allows attackers to crash the host application by supplying a maliciously crafted template that triggers an uncatchable StackOverflowException. The flaw stems from uncontrolled recursion in three code paths: postfix chains bypass depth limits, array comparisons lack cycle checks, and object.eval bypasses recursive limits.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if your system uses Scriban versions 7.5.2 or earlier. Inspect installed packages via package managers like NuGet for .NET or npm for JavaScript. For .NET, run 'dotnet list package | grep Scriban' or check project files for Scriban dependencies. For manual verification, examine assembly versions in binaries or logs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial of service by crashing the host process. Attackers can exploit it by providing specially crafted templates, even small ones, to trigger a stack overflow. The crash terminates the entire application, disrupting services and causing downtime.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes uncontrolled recursion leading to a stack overflow and process termination. For compliance, it primarily impacts availability requirements under standards like GDPR (data processing integrity) and HIPAA (system availability). The resulting denial-of-service could violate availability obligations if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Scriban to version 7.5.3 or later immediately. If upgrading is not possible, restrict template rendering to trusted sources only. Implement custom recursion depth checks in template processing pipelines. Monitor for unexpected process terminations in applications using Scriban.

Useful 0 Not Useful 0