Description

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger an uncatchable StackOverflowException that immediately terminates the host process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-16T14:16:56.133Z",
  "pubdate": "2026-08-16T14:16:56.133Z",
  "executiveSummary": "Scriban versions 6.6.0 through 7.2.0 are vulnerable to a denial of service vulnerability caused by a non-enforcing ExpressionDepthLimit guard during recursive descent parsing.\nThis flaw allows remote attackers to supply maliciously crafted templates containing deeply nested structures such as parentheses, array initializers, object initializers, or unary operators.\nWhen the parser processes these constructs, it fails to halt execution before exhausting the call stack, triggering an uncatchable StackOverflowException that immediately terminates the host process.\nThe risk implication is severe for applications embedding Scriban, as unauthenticated users can crash host services entirely with a single crafted input payload, disrupting availability without requiring elevated privileges or network exposure beyond template submission capabilities.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the ExpressionDepthLimit guard within the Scriban parsing engine, which fails to correctly enforce configured depth boundaries during recursive descent parsing of complex expressions.\nThe vulnerable component is the expression parser responsible for evaluating nested language constructs within Scriban templates.\nAffected versions include Scriban 6.6.0 through 7.2.0.\nAttackers exploit this vulnerability by submitting templates containing deeply nested syntax structures, such as cascading parentheses, recursive array initializers, nested object initializers, or continuous unary operators.\nStep-by-step attack flow begins when an application accepts an untrusted template string from an unauthenticated user and passes it to the Scriban parsing engine.\nAs the parser recursively evaluates the deeply nested nodes, the depth counter fails to trigger the intended abort mechanism, allowing the managed call stack to grow uncontrollably.\nOnce the maximum call stack capacity of the runtime environment is reached, a StackOverflowException is thrown.\nBecause a StackOverflowException in .NET cannot typically be caught by standard application-try-catch blocks, the CLR immediately terminates the host process, resulting in a complete denial of service.\nNo authentication or special privileges are required to exploit this flaw, provided the attacker has an avenue to supply template payloads to the vulnerable parsing component."
}