Vulnerability Description
Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger an uncatchable StackOverflowException that immediately terminates the host process.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/scriban/scriban/security/advisories/GHSA-6q7j-xr26-3h2c
- https://www.vulncheck.com/advisories/scriban-through-parser-recursion-denial-of-
- https://github.com/scriban/scriban/security/advisories/GHSA-6q7j-xr26-3h2c
FAQ
What is CVE-2026-74783?
CVE-2026-74783 is a vulnerability with a CVSS score of 7.5 (HIGH). Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with d...
How severe is CVE-2026-74783?
CVE-2026-74783 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-74783?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.