Denial of Service Vulnerability in Scriban Affected by Array Insert Function

CVE-2026-74784

What is CVE-2026-74784?

Scriban, prior to version 7.2.0, has a denial of service vulnerability stemming from the array.insert_at function. This vulnerability allows attackers to supply excessively large index parameters, resulting in unbounded null entries allocation. Consequently, it bypasses LoopLimit and LimitToString constraints, leading to an OutOfMemoryException that can crash the host process in less than a second. Proper safeguards against such excessive inputs are crucial to maintain system stability and security.

References