CVE-2026-74792: Scriban before 7.0.0 Stack Overflow via nested array initializers
Scriban before 7.0.0 (affected versions <= 6.6.0) contains a stack overflow vulnerability in nested array initializer parsing. Deeply nested array initializers recurse through a path (ParseArrayInitializer → ParseExpression → ParseArrayInitializer) that is not covered by the ExpressionDepthLimit counter added in the fix for GHSA-wgh7-7m3c-fx25. An attacker who can supply untrusted input to Template.Parse can trigger an uncatchable StackOverflowException that immediately terminates the process, even with the default ExpressionDepthLimit enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Scribanto a version that resolves this vulnerability.Fixed in 7.0.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch GHSA-wgh7-7m3c-fx25
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74792?
The severity of CVE-2026-74792 is rated as high with a score of 7.5.
What vulnerability does CVE-2026-74792 describe?
CVE-2026-74792 describes a stack overflow vulnerability in Scriban before version 7.0.0 due to nested array initializer parsing.
How do I fix CVE-2026-74792?
To fix CVE-2026-74792, upgrade to Scriban version 7.0.0 or later.
What software is affected by CVE-2026-74792?
Scriban versions 6.6.0 and earlier are affected by CVE-2026-74792.
What causes the CVE-2026-74792 vulnerability?
CVE-2026-74792 is caused by deeply nested array initializers that can lead to stack overflow through uncontrolled recursion.