Description

Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException that terminates the hosting process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-16T14:16:57.450Z",
  "pubdate": "2026-08-16T14:16:57.450Z",
  "executiveSummary": "Scriban before version 6.6.0 is susceptible to an infinite recursion vulnerability during object rendering operations. This security flaw stems from an unsafe default configuration where the ObjectRecursionLimit property remains unlimited.\nThreat actors can exploit this weakness by crafting and supplying malicious template contexts containing circular reference objects. When the templating engine attempts to render these deeply nested or self-referential structures, it enters an unmanageable recursive loop.\nThe primary impact of this exploitation is resource exhaustion, specifically consuming all available stack space within the execution thread. This condition triggers an uncatchable StackOverflowException in the runtime environment, resulting in the immediate and ungraceful termination of the hosting process.\nThis vulnerability poses a significant denial of service (DoS) risk to applications utilizing vulnerable versions of Scriban to process untrusted templates. Successful exploitation requires the ability to supply or influence input data within the template context, but does not necessitate authentication or elevated privileges.",
  "technicalDetails": "The vulnerability resides within the object rendering mechanisms of the Scriban template engine. Specifically, the component responsible for serializing or evaluating template objects fails to adequately track or limit object reference depths by default, as the ObjectRecursionLimit property is initialized to an unlimited state.\nWhen a user or attacker passes a circular reference object—an object graph where a child property references a parent or ancestor object—into the template context, the rendering function recursively traverses the object tree indefinitely.\nStep-by-step, the attack flow initiates when the application processes a template utilizing the maliciously crafted context. As the engine evaluates properties during the rendering phase, it makes recursive function calls to resolve nested object structures without detecting the cyclic reference. Each recursive iteration consumes stack frames for local variables and function execution states. Because the recursion lacks a boundary or cycle detection mechanism constrained by a safe default depth limit, the call stack grows exponentially until it exhausts the allocated memory space for the thread.\nUpon exhausting the stack memory, the .NET runtime throws a StackOverflowException. In modern .NET environments, this exception cannot be caught by standard try-catch blocks and immediately terminates the process to prevent memory corruption, causing a complete denial of service for the hosting application.\nThe vulnerability affects Scriban versions prior to 6.6.0. Exploitation does not require network exposure beyond the application's input vector, nor does it require authentication or specific privileges, provided the attacker can inject or manipulate the data structures passed to the Scriban template context."
}