Vulnerability Description
Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attackers who can supply templates can cause out-of-memory exceptions or CPU exhaustion, typically terminating the entire host process.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/scriban/scriban/security/advisories/GHSA-xw6w-9jjh-p9cr
- https://www.vulncheck.com/advisories/scriban-before-denial-of-service-via-unboun
- https://github.com/scriban/scriban/security/advisories/GHSA-xw6w-9jjh-p9cr
FAQ
What is CVE-2026-74785?
CVE-2026-74785 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigIn...
How severe is CVE-2026-74785?
CVE-2026-74785 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-74785?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.