CVE-2026-74788: Scriban before 7.0.0 Denial of Service via string.pad_left/pad_right
Scriban before 7.0.0 (affected versions <= 6.6.0) contains an uncontrolled memory allocation vulnerability in the string.padleft and string.padright template functions, which perform no validation on the width parameter before delegating to .NET's String.PadLeft/PadRight. When an application exposes Scriban to untrusted template input, an attacker can supply an arbitrarily large width value (e.g., 500,000,000) to trigger ~1GB memory allocations in a single call, resulting in OutOfMemoryException and denial of service. The TemplateContext.LimitToString limit does not prevent this because it is only enforced after the string has been fully allocated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Scribanto a version that resolves this vulnerability.Fixed in 7.0.0 - Configuration
Do not rely on TemplateContext.LimitToString to mitigate this issue, because enforcement happens only after the string has been fully allocated (OOM can occur before the limit is applied). Apply a different mitigation for untrusted template input.
Scriban TemplateContext LimitToString = unchanged - Compensating control
If your application exposes Scriban to untrusted template input, restrict/validate the template arguments/variables that flow into string.pad_left and string.pad_right so that the width parameter cannot be arbitrarily large (e.g., block or cap width values like 500,000,000 that would trigger ~1GB allocations).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74788?
The severity of CVE-2026-74788 is classified as high with a CVSS score of 7.5.
How do I fix CVE-2026-74788?
To fix CVE-2026-74788, update Scriban to version 7.0.0 or later.
What type of vulnerability is CVE-2026-74788?
CVE-2026-74788 is a denial of service vulnerability caused by uncontrolled memory allocation in template functions.
What are the affected versions of Scriban for CVE-2026-74788?
Affected versions of Scriban for CVE-2026-74788 are those prior to version 7.0.0, specifically up to version 6.6.0.
What are the consequences of exploiting CVE-2026-74788?
Exploiting CVE-2026-74788 can lead to a denial of service condition in applications using the affected Scriban versions.