Stack Overflow Vulnerability in Scriban Template Engine by Scriban

CVE-2026-74792

What is CVE-2026-74792?

The Scriban Template Engine versions prior to 7.0.0 are susceptible to a stack overflow vulnerability due to an improper handling of nested array initializers. When an attacker provides untrusted input to the Template.Parse function, it can lead to excessive recursion through the parsing process, specifically during the nested array initialization stages. This unchecked recursion can trigger an unrecoverable StackOverflowException, causing the application process to terminate unexpectedly. This issue remains unresolved even when using the default ExpressionDepthLimit setting.

References