Description

Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged iterations, pinning CPU cores and exhausting garbage collection resources even when LoopLimit is set to 1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-16T14:16:55.640Z",
  "pubdate": "2026-08-16T14:16:55.640Z",
  "executiveSummary": "Scriban versions from 3.0.0 through 7.2.5 suffer from a denial of service vulnerability residing within the ScriptRange.Multiply operator.\nThe vulnerability allows attackers to completely bypass the configured LoopLimit safeguard by supplying specially crafted templates that perform array multiplication operations against a lazy sequence as the left operand.\nThis condition forces the execution engine to process billions of uncharged iterations, which directly pins host CPU cores at maximum utilization and heavily exhausts garbage collection resources, causing severe performance degradation or total application unresponsiveness.\nThe impact affects systems and products utilizing the Scriban template engine where untrusted template input is processed.\nThe risk implications involve complete service disruption of dependent applications due to resource exhaustion.\nAttackers require the capability to supply malicious templates containing the specific multiplication vector against lazy sequences to trigger the flaw, while exploitation requirements rely purely on template evaluation without needing prior authentication or elevated privileges.",
  "technicalDetails": "The root cause of the vulnerability lies in the implementation of the ScriptRange.Multiply operator within the Scriban template engine, specifically affecting versions 3.0.0 through 7.2.5.\nWhen a template utilizes array multiplication where the left operand is a lazy sequence, the execution logic fails to properly account for iteration tracking against safety mechanisms.\nConsequently, this oversight completely bypasses the LoopLimit protection enforcement, even when LoopLimit is strictly configured to a value such as 1.\nThe vulnerable component is the ScriptRange.Multiply operator handling lazy sequences.\nAttack flow begins when an unauthenticated attacker with the ability to supply or modify template inputs submits a payload incorporating array multiplication operations targeting lazy sequences.\nUpon evaluation of the template, the Scriban engine processes the multiplication operator, initializing the lazy sequence without incrementing or enforcing the standard LoopLimit counters.\nThis permits the generation and iteration of billions of uncharged execution cycles within a single evaluation pass.\nThe payload behavior manifests as excessive, unthrottled CPU consumption that pins processing cores and floods memory management subsystems, severely exhausting garbage collection resources.\nPost-exploitation impact includes sustained denial of service conditions, thread starvation, and potential cascading failures across dependent microservices or host applications relying on the vulnerable Scriban engine for rendering.\nNo network exposure or special privileges are inherently required beyond the ability to submit template payloads for processing."
}