CVE-2026-74789: Scriban before 7.0.0 LoopLimit Bypass via Built-in Operations
Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and functions. As a result, a single expression such as {{ 1..1000000 | array.size }} — or a memory-amplification expression such as {{ 'A' 200000000 }} — can force large CPU or memory consumption even when LoopLimit is configured to a very small value, resulting in denial of service. Applications that render attacker-controlled templates and rely on LoopLimit for safe execution are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Scribanto a version that resolves this vulnerability.Fixed in 7.0.0 - Compensating control
If upgrading is not immediately possible, prevent attacker-controlled template rendering or otherwise isolate template rendering to mitigate CPU/memory denial-of-service caused by LoopLimit bypass via built-in operations (e.g., expressions like {{ 1..1000000 | array.size }} or {{ 'A' * 200000000 }}).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74789?
The severity of CVE-2026-74789 is high, with a CVSS score of 7.5.
How do I fix CVE-2026-74789?
To fix CVE-2026-74789, upgrade Scriban to version 7.0.0 or later.
What is the primary issue in CVE-2026-74789?
CVE-2026-74789 allows a LoopLimit bypass due to the application of constraints only to script loop statements.
What versions of Scriban are affected by CVE-2026-74789?
Scriban versions up to and including 6.6.0 are affected by CVE-2026-74789.
What types of operations are exploited in CVE-2026-74789?
CVE-2026-74789 is exploited through expensive iteration in built-in operators and functions.