Description

Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent parser. The parser does not enforce a default expression depth limit (the ExpressionDepthLimit property in ParserOptions defaults to null/disabled), so an attacker who controls template input can supply a deeply nested template (e.g., thousands of nested parentheses or blocks) that exhausts thread stack space and raises a StackOverflowException. Because a StackOverflowException cannot be caught in .NET, this causes immediate, unrecoverable termination of the hosting process, resulting in a denial of service. Applications that process untrusted or user-supplied templates can be exploited remotely without authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-16T14:16:57.590Z",
  "pubdate": "2026-08-16T14:16:57.590Z",
  "executiveSummary": "Scriban before version 6.6.0 suffers from an uncontrolled recursion vulnerability within its recursive-descent parser, classified as a denial of service (DoS) vector.\nThe vulnerability arises because the parser lacks a default enforcement for expression depth limits, leaving the ExpressionDepthLimit property in ParserOptions set to null or disabled by default.\nAn unauthenticated remote attacker who controls template input can supply a specially crafted, deeply nested template containing thousands of nested parentheses or blocks.\nWhen parsed, this input exhausts the thread stack space, triggering an uncatchable StackOverflowException in the .NET runtime.\nThe primary impact is the immediate, unrecoverable termination of the hosting application process, leading to a complete denial of service for dependent services.\nApplications processing untrusted or user-supplied templates are directly at risk and can be exploited remotely without requiring prior authentication or elevated privileges.",
  "technicalDetails": "The root cause of this vulnerability lies in the design of the Scriban recursive-descent parser, which processes template syntax structures without imposing a default ceiling on recursive function calls or nesting depth.\nThe vulnerable component is the expression parser module, specifically governed by the ParserOptions configuration class where the ExpressionDepthLimit property defaults to null, effectively disabling depth restrictions out-of-the-box.\nAffected software versions include all Scriban releases prior to version 6.6.0.\nThe attack flow proceeds as follows: an unauthenticated remote attacker identifies an endpoint or application feature that accepts user-supplied templates for processing.\nThe attacker crafts a malicious payload consisting of thousands of deeply nested constructs, such as recursive parenthesis groupings or highly nested block structures.\nUpon submission, the application passes this untrusted template into the Scriban parsing engine.\nAs the recursive-descent parser evaluates the AST (Abstract Syntax Tree) nodes, each level of nesting invokes subsequent recursive parser functions, continuously allocating local variables and stack frames.\nBecause the ExpressionDepthLimit is unconstrained, the recursion depth exceeds the physical limits allocated to the managed thread stack.\nThis exhaustion instantly precipitates a StackOverflowException within the execution environment.\nIn the .NET runtime, a StackOverflowException is catastrophic and cannot be intercepted by standard try-catch exception handling blocks, bypassing standard error handling routines.\nConsequently, the hosting process crashes immediately without performing graceful shutdown procedures, resulting in an unrecoverable denial of service.\nNetwork exposure is contingent on the application surface, but typical attack vectors involve web applications, server-side template rendering pipelines, or microservices exposed to remote callers.\nNo special privileges or authentication are required if the application exposes template parsing functionality to external users."
}