Vulnerability · Published Aug 16, 2026 · Assigned by VulnCheck

CVE-2026-74788Scriban before 7.0.0 Denial of Service via string.pad_left/pad_right

High 7.5

In plain English

A high-severity resource allocation without limits in scriban from scriban. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 57.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Scriban before 7.0.0 (affected versions <= 6.6.0) contains an uncontrolled memory allocation vulnerability in the string.pad_left and string.pad_right template functions, which perform no validation on the width parameter before delegating to .NET's String.PadLeft/PadRight. When an application exposes Scriban to untrusted template input, an attacker can supply an arbitrarily large width value (e.g., 500,000,000) to trigger ~1GB memory allocations in a single call, resulting in OutOfMemoryException and denial of service. The TemplateContext.LimitToString limit does not prevent this because it is only enforced after the string has been fully allocated.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
NuGet	scriban	7.0.0	GHSA-v66j-x4hw-fv9g
NuGet	scriban.signed	7.0.0	GHSA-v66j-x4hw-fv9g

Affected products (as reported)

Vendor	Product	Versions
scriban	scriban	0 – before 7.0.0

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-v66j-x4hw-fv9g) vendor-advisory
VulnCheck Advisory: Scriban before 7.0.0 Denial of Service via string.pad_left/pad_right third-party-advisory