CVE-2026-74787: Scriban before 7.0.0 Uncontrolled Recursion via object.to_json

Q: What is the severity of CVE-2026-74787?

CVE-2026-74787 has a severity rating of high, with a score of 7.5.

Q: How do I fix CVE-2026-74787?

To address CVE-2026-74787, upgrade to Scriban version 7.0.0 or later where the vulnerability is resolved.

Q: What type of vulnerability is CVE-2026-74787?

CVE-2026-74787 is an uncontrolled recursion vulnerability in the object.to_json function.

Q: What impact does CVE-2026-74787 have?

CVE-2026-74787 can lead to a StackOverflowException due to unbounded recursion triggered by specially crafted templates.

Q: Who is affected by CVE-2026-74787?

Any user of Scriban versions prior to 7.0.0 is potentially affected by CVE-2026-74787.

Published Aug 16, 2026

Updated

Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.tojson builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverflowException that fatally terminates the hosting .NET process.

Affected Software

1 affected component

Scriban Scriban<7.0.0

Event History

Aug 16, 2026

CVE Published

via MITRE·01:14 PM

Data Sourced

via MITRE·01:14 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-74787?

CVE-2026-74787 has a severity rating of high, with a score of 7.5.

How do I fix CVE-2026-74787?

To address CVE-2026-74787, upgrade to Scriban version 7.0.0 or later where the vulnerability is resolved.

What type of vulnerability is CVE-2026-74787?

CVE-2026-74787 is an uncontrolled recursion vulnerability in the object.to_json function.

What impact does CVE-2026-74787 have?

CVE-2026-74787 can lead to a StackOverflowException due to unbounded recursion triggered by specially crafted templates.

Who is affected by CVE-2026-74787?