CVE-2026-74789
Received Received - Intake

Denial of Service in Scriban Template Engine

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: VulnCheck

Description
Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and functions. As a result, a single expression such as {{ 1..1000000 | array.size }} — or a memory-amplification expression such as {{ 'A' * 200000000 }} — can force large CPU or memory consumption even when LoopLimit is configured to a very small value, resulting in denial of service. Applications that render attacker-controlled templates and rely on LoopLimit for safe execution are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-74789
EUVD
EUVD-2026-59955

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
scriban scriban to 7.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Scriban before 7.0.0 fails to enforce its LoopLimit constraint on expensive operations inside built-in functions and operators. Attackers can craft expressions like {{ 1..1000000 | array.size }} or {{ 'A' * 200000000 }} to consume excessive CPU or memory, bypassing LoopLimit and causing denial of service.

Detection Guidance

Detect this vulnerability by monitoring for unusually high CPU or memory usage during template rendering. Check Scriban versions below 7.0.0 in your environment. Look for expressions like {{ 1..1000000 | array.size }} or {{ 'A' * 200000000 }} in templates that may cause excessive resource consumption.

Impact Analysis

If you use Scriban to render templates with attacker-controlled input, this flaw could allow attackers to crash your application by consuming all available CPU or memory resources, leading to downtime or service disruption.

Compliance Impact

This vulnerability could lead to denial-of-service conditions due to excessive CPU or memory consumption, which may impact system availability and reliability. For GDPR, this could affect the right to uninterrupted service under Article 32 (security of processing). For HIPAA, it may violate the Security Rule's requirements for ensuring availability of ePHI. Organizations relying on Scriban for template processing with untrusted input may face compliance risks if this issue is not addressed.

Mitigation Strategies

Upgrade Scriban to version 7.0.0 or later to address the LoopLimit constraint issue. If upgrading is not immediately possible, restrict template rendering to trusted sources and implement resource limits on template execution to prevent denial of service.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74789. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart