nuget Scriban.Signed vulnerabilities

Latest nuget Scriban.Signed CVEs

Newest publication first

1. CVE-2026-124439 Scriban before 7.5.3 Denial of Service via Uncatchable StackOverflowException

   Published 2026-11-08

   High·CVSS 8.7 EPSS 0.45%

   Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison lacks depth and cycle checks, and object.eval bypasses RecursiveLimit. Attackers who can supply templates c...

2. CVE-2026-124438 Scriban before 7.5.2 Delegate Target Exposure via array.map Member Access

   Published 2026-11-08

   Critical·CVSS 9.1 EPSS 0.36%

   Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on importe...

3. CVE-2026-124437 Scriban before 7.5.3 Denial of Service via Unguarded Builtins and Recursion

   Published 2026-11-08

   High·CVSS 8.7 EPSS 0.42%

   Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust memory and CPU because builtins like math.format, regex.replace and string.escape skip the LimitToString allocation guard. Attackers can submit small templates usin...

4. CVE-2026-74794 Scriban before 6.6.0 Denial of Service via Infinite Recursion

   Published 2026-08-16

   High·CVSS 8.7 EPSS 0.49%

   Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackO...

5. CVE-2026-74795 Scriban before 6.6.0 Denial of Service via Uncontrolled Recursion

   Published 2026-08-16

   High·CVSS 8.7 EPSS 0.58%

   Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent parser. The parser does not enforce a default expression depth limit (the ExpressionDepthLimit property in ParserOptions defaults to null/disabled), so an attacker who controls template...

6. CVE-2026-74792 Scriban before 7.0.0 Stack Overflow via nested array initializers

   Published 2026-08-16

   High·CVSS 8.7 EPSS 0.53%

   Scriban before 7.0.0 (affected versions <= 6.6.0) contains a stack overflow vulnerability in nested array initializer parsing. Deeply nested array initializers recurse through a path (ParseArrayInitializer → ParseExpression → ParseArrayInitializer) that is not covered by the Expr...

7. CVE-2026-74791 Scriban before 7.0.0 Authorization Bypass via Stale Include Cache

   Published 2026-08-16

   Critical·CVSS 9.2 EPSS 0.43%

   Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template...

8. CVE-2026-74790 Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache

   Published 2026-08-16

   Critical·CVSS 9.3 EPSS 0.47%

   Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tighten...

9. CVE-2026-74789 Scriban before 7.0.0 LoopLimit Bypass via Built-in Operations

   Published 2026-08-16

   High·CVSS 8.7 EPSS 0.60%

   Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and functions. As a result, a single expression such as {{ 1..1000000 | array.size }} — or a memory-amplific...

10. CVE-2026-74788 Scriban before 7.0.0 Denial of Service via string.pad_left/pad_right

    Published 2026-08-16

    High·CVSS 8.7 EPSS 0.49%

    Scriban before 7.0.0 (affected versions <= 6.6.0) contains an uncontrolled memory allocation vulnerability in the string.pad_left and string.pad_right template functions, which perform no validation on the width parameter before delegating to .NET's String.PadLeft/PadRight. When...

11. CVE-2026-74787 Scriban before 7.0.0 Uncontrolled Recursion via object.to_json

    Published 2026-08-16

    High·CVSS 8.7 EPSS 0.49%

    Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.to_json builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverfl...

12. CVE-2026-74786 Scriban before 7.0.0 Denial of Service via Unbounded Template Output

    Published 2026-08-16

    High·CVSS 7.1 EPSS 0.48%

    Scriban before 7.0.0 (affected versions <= 6.6.0) contains a denial-of-service vulnerability in which the LimitToString safety limit (default 1MB) can be bypassed because ObjectToString resets the per-call length counter (_currentToStringLength) on every top-level call and String...

13. CVE-2026-74785 Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption

    Published 2026-08-16

    High·CVSS 7.1 EPSS 0.48%

    Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin fu...

14. CVE-2026-74784 Scriban before 7.2.0 Denial of Service via array.insert_at

    Published 2026-08-16

    High·CVSS 8.7 EPSS 0.45%

    Scriban before 7.2.0 contains a denial of service vulnerability in the array.insert_at function that allocates unbounded null entries without respecting LoopLimit or LimitToString constraints. Attackers can supply a large index parameter to trigger OutOfMemoryException and crash...

15. CVE-2026-74783 Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service

    Published 2026-08-16

    High·CVSS 8.7 EPSS 0.34%

    Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary oper...

16. CVE-2026-73062 Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication

    Published 2026-08-16

    High·CVSS 8.7 EPSS 0.49%

    Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. Attackers can supply a large integer multiplier in a template to force multi-g...

17. GHSA-5rpf-x9jg-8j5p Scriban Affected by Memory Exhaustion (OOM) via Unbounded String Generation (Denial of Service)

    Published 2026-03-19

    Medium·CVSS 5.3

    TemplateContext.LimitToString defaults to 0 (unlimited). While Scriban implements a default LoopLimit of 1000, an attacker can still cause massive memory allocation via exponential string growth. Doubling a string for just 30 iterations generates over 1GB of text, instantly exhau...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.