Vulnerability Description
Scriban before 7.0.0 (affected versions <= 6.6.0) contains an uncontrolled memory allocation vulnerability in the string.pad_left and string.pad_right template functions, which perform no validation on the width parameter before delegating to .NET's String.PadLeft/PadRight. When an application exposes Scriban to untrusted template input, an attacker can supply an arbitrarily large width value (e.g., 500,000,000) to trigger ~1GB memory allocations in a single call, resulting in OutOfMemoryException and denial of service. The TemplateContext.LimitToString limit does not prevent this because it is only enforced after the string has been fully allocated.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/scriban/scriban/security/advisories/GHSA-v66j-x4hw-fv9g
- https://www.vulncheck.com/advisories/scriban-before-denial-of-service-via-string
- https://github.com/scriban/scriban/security/advisories/GHSA-v66j-x4hw-fv9g
FAQ
What is CVE-2026-74788?
CVE-2026-74788 is a vulnerability with a CVSS score of 7.5 (HIGH). Scriban before 7.0.0 (affected versions <= 6.6.0) contains an uncontrolled memory allocation vulnerability in the string.pad_left and string.pad_right template functions, which perform no validation o...
How severe is CVE-2026-74788?
CVE-2026-74788 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-74788?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.