Description

Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and functions. As a result, a single expression such as {{ 1..1000000 | array.size }} — or a memory-amplification expression such as {{ 'A' * 200000000 }} — can force large CPU or memory consumption even when LoopLimit is configured to a very small value, resulting in denial of service. Applications that render attacker-controlled templates and rely on LoopLimit for safe execution are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-16T14:16:56.917Z",
  "pubdate": "2026-08-16T14:16:56.917Z",
  "executiveSummary": "Scriban before 7.0.0 (affected versions <= 6.6.0) is susceptible to a denial of service vulnerability caused by an incomplete resource constraint enforcement mechanism.\nThe vulnerability arises because the LoopLimit security constraint is exclusively applied to explicit script loop statements, failing to restrict expensive iteration and allocation performed inside built-in operators and functions.\nAn unauthenticated attacker capable of supplying or modifying attacker-controlled templates can exploit this limitation by submitting crafted expressions, such as heavy numerical ranges piped to built-in functions or massive string multiplication payloads.\nThis forces excessive CPU processing and massive memory consumption on the host application, leading to resource exhaustion and potential service disruption.\nApplications that rely on the LoopLimit configuration as a primary security boundary for executing untrusted templates are directly at risk.\nMitigation requires updating Scriban to version 7.0.0 or later, where built-in operators and functions properly respect resource limitations.",
  "technicalDetails": "The root cause of the vulnerability resides in the enforcement logic of the LoopLimit constraint within the Scriban templating engine. Specifically, the parsing and evaluation engine restricts iterations only within explicit script loop constructs while omitting parallel enforcement for implicit iteration or memory allocation routines executed by built-in operators and functions.\nThe vulnerable components include the template evaluation engine, built-in operator handlers, and functions that process large ranges, arrays, or string multiplications without inheriting execution limits.\nAffected versions comprise all releases of Scriban up to and including version 6.6.0, prior to version 7.0.0.\nExploitation does not require authentication or elevated privileges, provided the target application processes attacker-controlled template inputs and executes them within an environment configured with a restricted LoopLimit.\nThe attack flow proceeds as follows: First, an adversary crafts a malicious template payload containing expressions designed to abuse built-in functions, such as {{ 1..1000000 | array.size }} to induce heavy CPU usage through massive range evaluation, or memory-amplification expressions such as {{ 'A' * 200000000 }} to exhaust available system memory.\nSecond, the attacker submits this payload to the vulnerable application for rendering.\nThird, the template engine processes the expression. Because built-in operators bypass the LoopLimit check, the engine executes the full scope of the requested iteration or memory allocation.\nFinally, the server experiences high resource contention, CPU starvation, or out-of-memory errors, resulting in a denial of service condition affecting legitimate application users."
}