CVE-2026-73060: Scriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiply
Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged iterations, pinning CPU cores and exhausting garbage collection resources even when LoopLimit is set to 1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Scribanto a version that resolves this vulnerability.Fixed in 7.2.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73060?
The severity of CVE-2026-73060 is categorized as high with a score of 7.5.
How does CVE-2026-73060 affect Scriban?
CVE-2026-73060 allows attackers to create a denial of service condition via the ScriptRange.Multiply operator when using lazy sequences.
What versions of Scriban are vulnerable to CVE-2026-73060?
Scriban versions from 3.0.0 through 7.2.5 are vulnerable to CVE-2026-73060.
How can I mitigate the risk of CVE-2026-73060?
To mitigate CVE-2026-73060, upgrade Scriban to a version that has patched this vulnerability.
What type of attack is associated with CVE-2026-73060?
CVE-2026-73060 is associated with a denial of service attack resulting from uncontrolled iterations in array multiplication on lazy sequences.