CVE-2026-74795
Received Received - Intake

Stack Overflow in Scriban Template Engine

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: VulnCheck

Description
Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent parser. The parser does not enforce a default expression depth limit (the ExpressionDepthLimit property in ParserOptions defaults to null/disabled), so an attacker who controls template input can supply a deeply nested template (e.g., thousands of nested parentheses or blocks) that exhausts thread stack space and raises a StackOverflowException. Because a StackOverflowException cannot be caught in .NET, this causes immediate, unrecoverable termination of the hosting process, resulting in a denial of service. Applications that process untrusted or user-supplied templates can be exploited remotely without authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-74795
EUVD
EUVD-2026-59960

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
scriban scriban to 6.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an uncontrolled recursion flaw in Scriban versions before 6.6.0. The parser lacks a default depth limit for expressions, allowing attackers to submit deeply nested templates that exhaust thread stack space. This triggers a StackOverflowException, which cannot be caught in .NET, causing the hosting process to crash immediately. The issue enables remote denial of service without authentication.

Detection Guidance

To detect this vulnerability, monitor for applications using Scriban versions prior to 6.6.0 processing untrusted templates. Check for stack overflow errors or process crashes in logs when parsing deeply nested templates. Use tools like Wireshark to inspect network traffic for template submissions if the application is web-facing.

Impact Analysis

If you use Scriban to process untrusted templates, an attacker could exploit this to crash your application or service. This leads to downtime, service unavailability, and potential data loss if the process cannot recover. The attack requires no authentication and can be executed remotely.

Compliance Impact

This vulnerability causes a denial of service by crashing the hosting process, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing systems, potentially violating Article 32 requirements for resilience. For HIPAA, service disruptions could affect access to protected health information, potentially compromising the integrity and availability requirements of the Security Rule.

Mitigation Strategies

Immediately upgrade Scriban to version 6.6.0 or later. If upgrading is not possible, set a default value for the ExpressionDepthLimit property in ParserOptions to 250 or 1000 to prevent stack exhaustion. Disable or restrict access to template processing features for untrusted users until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74795. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart