Uncontrolled Memory Allocation in Scriban Template Functions by Scriban

CVE-2026-74788

What is CVE-2026-74788?

Scriban, a popular template engine, is impacted by an uncontrolled memory allocation vulnerability in its string.pad_left and string.pad_right functions. This vulnerability arises from the lack of validation on the width parameter when delegating operations to the .NET String.PadLeft and PadRight methods. An attacker can exploit this flaw by providing excessively large width values through untrusted template inputs, potentially triggering massive memory allocations, resulting in OutOfMemoryExceptions and denial of service. The limitation set in TemplateContext.LimitToString is ineffective as it is only enforced post allocation, leaving systems vulnerable to attack.

References