Description

Scriban before 7.0.0 (affected versions <= 6.6.0) contains a denial-of-service vulnerability in which the LimitToString safety limit (default 1MB) can be bypassed because ObjectToString resets the per-call length counter (_currentToStringLength) on every top-level call and StringBuilderOutput enforces no cumulative output-size limit. An attacker who can supply a template can render a near-limit string repeatedly in a loop, allocating approximately 1GB of memory and causing an out-of-memory condition that crashes the host application.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-16T14:16:56.523Z",
  "pubdate": "2026-08-16T14:16:56.523Z",
  "executiveSummary": "Scriban before version 7.0.0, specifically affecting versions 6.6.0 and prior, contains a denial-of-service vulnerability arising from a flaw in safety limit enforcement during string conversion.\nThe vulnerability allows an attacker capable of supplying a template to repeatedly render near-limit strings within a loop, circumventing the intended LimitToString safety limit of 1MB.\nThis behavior leads to excessive memory allocation of approximately 1GB, triggering an out-of-memory condition that results in the crash of the host application.\nThe primary impact is the complete unavailability of the affected system or application, presenting a high risk for services that process untrusted templates.\nExploitation requires the ability to supply and execute arbitrary template input against the vulnerable parsing and rendering engine.",
  "technicalDetails": "The vulnerability resides within the string conversion and output handling components of Scriban, specifically involving the LimitToString safety limit, the ObjectToString function, and the StringBuilderOutput mechanism.\nThe root cause of the vulnerability is twofold: ObjectToString resets the per-call length counter (_currentToStringLength) on every top-level call, and StringBuilderOutput enforces no cumulative output-size limit across multiple operations.\nWhile the default LimitToString safety limit is configured to 1MB to prevent excessive memory consumption per string conversion operation, the resetting mechanism allows this boundary to be repeatedly approached without tracking cumulative growth.\nAn attacker exploits this flaw by crafting a malicious template containing a loop structure that repeatedly invokes string generation operations, rendering a string just under the 1MB limit in each iteration.\nBecause the per-call length counter is reset with each top-level call and the underlying StringBuilderOutput does not aggregate or restrict cumulative output size, the application continues to allocate memory for each iteration.\nThe attack flow proceeds as follows: 1) The attacker submits a specially crafted template containing a repetitive loop. 2) The Scriban rendering engine processes the loop, executing top-level string conversions that repeatedly trigger the reset of _currentToStringLength. 3) Each iteration outputs a near-limit string, bypassing the intended cumulative safety threshold. 4) The continuous allocation accumulates approximately 1GB of memory.\nThis rapid and unrestrained memory consumption exhausts available system resources, leading directly to an out-of-memory condition and causing the host application to crash.\nThe affected versions include all releases of Scriban prior to version 7.0.0, with version 6.6.0 explicitly confirmed as vulnerable.\nNo specific authentication, privileges, or network exposure are inherently required beyond the ability to supply a template to the application rendering engine."
}