Vulnerability · Published Aug 16, 2026 · Assigned by VulnCheck
CVE-2026-74789Scriban before 7.0.0 LoopLimit Bypass via Built-in Operations
High 7.5
In plain English
A high-severity uncontrolled resource consumption in scriban from scriban. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and functions. As a result, a single expression such as {{ 1..1000000 | array.size }} — or a memory-amplification expression such as {{ 'A' * 200000000 }} — can force large CPU or memory consumption even when LoopLimit is configured to a very small value, resulting in denial of service. Applications that render attacker-controlled templates and rely on LoopLimit for safe execution are affected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | scriban | 7.0.0 | GHSA-c875-h985-hvrc |
| NuGet | scriban.signed | 7.0.0 | GHSA-c875-h985-hvrc |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-c875-h985-hvrc) vendor-advisory
- VulnCheck Advisory: Scriban before 7.0.0 LoopLimit Bypass via Built-in Operations third-party-advisory