Description

Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attackers who can supply templates can cause out-of-memory exceptions or CPU exhaustion, typically terminating the entire host process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-16T14:16:56.390Z",
  "pubdate": "2026-08-16T14:16:56.390Z",
  "executiveSummary": "Scriban before version 7.0.0 contains three distinct denial-of-service vulnerabilities residing within its expression evaluation engine.\nThese vulnerabilities allow threat actors to successfully bypass existing safety controls implemented by the template engine.\nThe primary impact involves resource exhaustion conditions, specifically triggering out-of-memory exceptions and CPU consumption that typically terminate the entire host process.\nThe affected product is Scriban in versions prior to 7.0.0.\nThe risk implications are severe for applications embedding the template engine, as unauthenticated attackers capable of supplying untrusted templates can cause complete application unavailability and service disruption.\nExploitation requires the attacker to have the ability to supply or modify template content processed by the vulnerable Scriban engine.",
  "technicalDetails": "The vulnerabilities stem from inadequate input validation and missing resource bounding in specific expression evaluation components within Scriban before version 7.0.0.\nThe first vector involves unbounded string multiplication, allowing an attacker to construct expressions that rapidly allocate excessive memory through repeated string concatenations.\nThe second vector relies on uncontrolled BigInteger shift operations, which can be manipulated to consume vast CPU resources and memory allocations during arithmetic evaluation.\nThe third vector bypasses existing LoopLimit protections via range enumeration executed within builtin functions, enabling nested or large-scale iterations that exceed intended execution bounds without tripping standard safety counters.\nThe attack flow begins when an attacker crafts a malicious template containing payloads leveraging unbounded string multiplication, heavy BigInteger bit shifts, or range-based LoopLimit bypasses.\nUpon submission, the Scriban expression evaluator parses and executes the template without enforcing sufficient constraints on these specific operations.\nAs the evaluation proceeds, memory consumption escalates uncontrollably or the CPU enters sustained heavy computation loops.\nThis behavior results in fatal out-of-memory exceptions or thread starvation, ultimately terminating the host process executing the application.\nThe affected component is the Scriban expression evaluator and builtin function handling.\nThe vulnerability affects all versions of Scriban prior to 7.0.0, requiring no special authentication or privileges beyond the ability to input template data."
}