Denial-of-Service Vulnerability in Scriban by Scriban

CVE-2026-74786

What is CVE-2026-74786?

Scriban versions up to 6.6.0 are susceptible to a denial-of-service vulnerability that allows the LimitToString safety limit to be bypassed. This occurs due to an issue in the ObjectToString function, which resets the length counter on each top-level call. As a result, attackers can repeatedly generate long strings in a loop, leading to excessive memory allocation (approximately 1GB). This can ultimately result in an out-of-memory condition that crashes the host application, jeopardizing the system's availability.

References