CVE-2026-74787
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.to_json builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverflowException that fatally terminates the hosting .NET process.
Risk Assessment
An attacker can remotely crash the hosting application, leading to service disruption and potential availability loss.
Recommendation
Upgrade Scriban to version 7.0.0 or later, which includes fixes for recursion limits and circular reference detection.
Original NVD description (English source)
Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.to_json builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverflowException that fatally terminates the hosting .NET process.