Description

Scriban before 7.0.0 (affected versions <= 6.6.0) contains an uncontrolled memory allocation vulnerability in the string.pad_left and string.pad_right template functions, which perform no validation on the width parameter before delegating to .NET's String.PadLeft/PadRight. When an application exposes Scriban to untrusted template input, an attacker can supply an arbitrarily large width value (e.g., 500,000,000) to trigger ~1GB memory allocations in a single call, resulting in OutOfMemoryException and denial of service. The TemplateContext.LimitToString limit does not prevent this because it is only enforced after the string has been fully allocated.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-16T14:16:56.787Z",
  "pubdate": "2026-08-16T14:16:56.787Z",
  "executiveSummary": "Scriban before version 7.0.0 (including versions <= 6.6.0) contains an uncontrolled memory allocation vulnerability residing in the string.pad_left and string.pad_right template functions.\nThis vulnerability leads to a denial of service (DoS) via an OutOfMemoryException when processing maliciously crafted templates.\nThe affected systems are applications utilizing Scriban to process untrusted template input where template authors can influence function parameters.\nThe risk implication is high for services exposed to external users, as low-privileged or unauthenticated attackers can disrupt application availability with minimal effort.\nAttacker capabilities include the ability to supply arbitrarily large width values within template function calls.\nExploitation requires the application to expose Scriban parsing and evaluation to untrusted template input.",
  "technicalDetails": "The root cause of the vulnerability is the absence of input validation on the width parameter within the string.pad_left and string.pad_right template functions.\nWhen these functions are executed, they directly delegate the width parameter to the underlying .NET methods String.PadLeft and String.PadRight without checking if the requested size exceeds reasonable resource boundaries.\nThe existing security control, TemplateContext.LimitToString, fails to mitigate this vector because the limit is enforced strictly after the large string has already been fully allocated in memory.\nThe vulnerable components are the string manipulation helper functions string.pad_left and string.pad_right within the Scriban templating engine across all versions up to 6.6.0.\nNo authentication or specific privileges are required to exploit this issue if the application permits untrusted users to submit or render arbitrary Scriban templates.\nThe attack vector is network-based or application-layer, depending on how the template engine is exposed to users via web forms, APIs, or file upload functionalities.\nThe payload behavior involves passing an excessively large integer value as the width parameter to either string.pad_left or string.pad_right, such as 500,000,000.\nDuring step-by-step exploitation, the attacker submits an untrusted template containing the malicious function call. Upon parsing and evaluation, Scriban invokes the underlying .NET string padding logic with the oversized parameter. This immediately triggers a massive memory allocation of approximately 1GB per function call within the managed heap. The abrupt memory exhaustion causes an OutOfMemoryException, terminating the application thread or crashing the hosting process entirely, thereby achieving a denial of service."
}