CVE-2026-124439: Scriban before 7.5.3 Denial of Service via Uncatchable StackOverflowException

Published Nov 8, 2026

Updated

Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison lacks depth and cycle checks, and object.eval bypasses RecursiveLimit. Attackers who can supply templates can trigger an uncatchable StackOverflowException that terminates the host process.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Scriban and Scriban.Signed to a version that resolves this vulnerability.
Fixed in 7.5.3

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

Applications using Scriban or Scriban.Signed before 7.5.3 are exposed if an attacker can supply templates for the application to parse or execute. Successful exploitation terminates the host process.

What does an attacker need to exploit the flaw?

The attacker needs the ability to provide a template. The supplied template can use uncontrolled recursive constructs involving postfix member, indexer, or call chains, array comparisons, or object.eval.

Are configured recursion or expression-depth limits sufficient mitigation?

No. The affected behaviors bypass ExpressionDepthLimit and RecursiveLimit, while array comparison lacks depth and cycle checks. Limits configured through those mechanisms do not prevent the described stack-overflow condition.

What version should be used to remediate the issue?

Upgrade Scriban or Scriban.Signed to version 7.5.3 or later. The issue affects versions before 7.5.3.

CVE-2026-124439: Scriban before 7.5.3 Denial of Service via Uncatchable StackOverflowException

Remediation

Event History

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What does an attacker need to exploit the flaw?

Are configured recursion or expression-depth limits sufficient mitigation?

What version should be used to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What does an attacker need to exploit the flaw?

Are configured recursion or expression-depth limits sufficient mitigation?

What version should be used to remediate the issue?