CVE-2026-74784
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Scriban before 7.2.0 contains a denial of service vulnerability in the array.insert_at function that allocates unbounded null entries without respecting LoopLimit or LimitToString constraints. Attackers can supply a large index parameter to trigger OutOfMemoryException and crash the host process in under a second.
Risk Assessment
An attacker can quickly exhaust memory and crash the application, leading to service disruption.
Recommendation
Upgrade Scriban to version 7.2.0 or later, which limits memory allocation in array.insert_at.
Original NVD description (English source)
Scriban before 7.2.0 contains a denial of service vulnerability in the array.insert_at function that allocates unbounded null entries without respecting LoopLimit or LimitToString constraints. Attackers can supply a large index parameter to trigger OutOfMemoryException and crash the host process in under a second.