Uncontrolled Recursion in Scriban's object.to_json Function

CVE-2026-74787

What is CVE-2026-74787?

Scriban, a popular templating engine for .NET, is susceptible to an uncontrolled recursion vulnerability via its object.to_json built-in function. This vulnerability arises from the lack of depth limits and insufficient detection of circular references. Attackers can exploit this flaw by crafting malicious templates with self-referencing objects, leading to unbounded recursion. Such exploitation can result in a StackOverflowException, which ultimately terminates the hosting .NET process, causing potential downtime and disrupting services.

References