Description

Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.to_json builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverflowException that fatally terminates the hosting .NET process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-16T14:16:56.653Z",
  "pubdate": "2026-08-16T14:16:56.653Z",
  "executiveSummary": "An uncontrolled recursion vulnerability exists in the Scriban templating engine prior to version 7.0.0, specifically within the object.to_json builtin serialization function.\nThe vulnerability is characterized by a complete absence of recursion depth limits and circular reference detection mechanisms during object serialization.\nExploitation of this flaw allows malicious actors to craft specialized template payloads containing self-referencing objects.\nWhen processed by the vulnerable serialization engine, these crafted templates trigger unbounded recursive execution.\nThis uncontrolled recursion immediately precipitates a unhandled StackOverflowException, resulting in the fatal termination of the hosting .NET process and causing a severe denial of service condition.\nThe risk implications are significant for any application utilizing unvalidated or untrusted templates that invoke the affected serialization builtin.\nAttacker capabilities are limited to inducing a crash of the host process, thereby disrupting service availability without requiring authentication or elevated privileges, provided they can supply or influence the template content processed by Scriban.",
  "technicalDetails": "The root cause of the vulnerability resides in the object.to_json builtin function implemented within the Scriban templating engine for .NET environments.\nDuring the serialization process, the underlying function traverses object graphs recursively to convert template objects into their JSON representations.\nThe vulnerable component fails to implement vital safeguards standard in robust serialization libraries, namely recursion depth tracking counters and cycle detection algorithms to identify previously visited object references.\nAffected versions include all Scriban releases prior to version 7.0.0.\nNo specific authentication requirements, privilege requirements, or network exposure prerequisites are inherent to the vulnerability itself; exposure is entirely dependent on whether the application exposes the template rendering engine to untrusted input sources.\nThe attack flow proceeds as follows: First, an attacker constructs a malicious template payload utilizing Scriban syntax that defines self-referencing data structures or deeply nested object hierarchies designed to induce infinite traversal loops.\nSecond, the attacker submits this payload to the hosting .NET application for evaluation and rendering.\nThird, when the application executes the template and invokes the object.to_json function on the malicious object graph, the serialization routine enters an unbounded recursive loop.\nFourth, as the recursion depth increases unchecked, the managed thread quickly exhausts its allocated stack space.\nFinally, the runtime throws a StackOverflowException, which cannot be reliably caught by standard try-catch blocks in modern .NET environments, leading to the immediate and fatal termination of the hosting process and successfully executing a denial of service attack."
}