Denial of Service Vulnerability in Scriban Template Engine from Scriban

CVE-2026-74789

What is CVE-2026-74789?

The Scriban Template Engine, versions 6.6.0 and earlier, is vulnerable due to a flaw in its LoopLimit constraint implementation. This vulnerability allows for excessive CPU and memory consumption when executing certain built-in operations, despite the LoopLimit being set to a minimal value. Specifically, expressions that involve large iterations, like {{ 1..1000000 | array.size }}, or memory-intensive expressions, such as {{ 'A' * 200000000 }}, can lead to a denial of service. Applications using Scriban for rendering templates, particularly those that permit user-controlled input, are at risk as they may not adequately mitigate these heavy resource demands.

References