CVE-2026-74783: Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service
Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger an uncatchable StackOverflowException that immediately terminates the host process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Scribanto a version that resolves this vulnerability.Fixed in 7.2.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74783?
The severity of CVE-2026-74783 is classified as high with a score of 7.5.
How do I fix CVE-2026-74783?
To fix CVE-2026-74783, upgrade Scriban to a version later than 7.2.0.
What kind of attack does CVE-2026-74783 enable?
CVE-2026-74783 enables a Denial of Service (DoS) attack through recursive parsing of deeply nested expressions.
Which versions of Scriban are affected by CVE-2026-74783?
Scriban versions 6.6.0 through 7.2.0 are affected by CVE-2026-74783.
What impact does CVE-2026-74783 have on Scriban?
CVE-2026-74783 can cause Scriban to become unresponsive due to excessive resource consumption from improper handling of deeply nested expressions.