Uncontrolled Recursion Vulnerability in Scriban by Scriban Technologies

CVE-2026-74795

What is CVE-2026-74795?

Scriban, a template engine, is susceptible to an uncontrolled recursion vulnerability due to its recursive-descent parsing mechanism. This oversight allows attackers to manipulate template input by providing deeply nested constructs, potentially thousands of layers deep. Because Scriban does not enforce a default depth limit for its parsing process, this can lead to exhaustion of the thread stack space and trigger a StackOverflowException. Since this exception is unrecoverable in .NET, it results in the permanent termination of the hosting application. This vulnerability can be exploited remotely by attackers exploiting untrusted user-supplied templates, leading to significant operational disruptions.

References