Is CVE-2026-124439 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124439 being exploited in the wild.

How severe is CVE-2026-124439?

High severity, with a CVSS score of 7.5, published 8 November 2026.

Which products and versions are affected?

Scriban before 7.5.3; Scriban.Signed before 7.5.3.

Is there a fix for CVE-2026-124439?

Yes: fixed in 7.5.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-124439 attacked?

It is attacked over the network.

Am I affected by CVE-2026-124439?

Check whether you run Scriban or Scriban.Signed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124439: Scriban uncontrolled recursion in template parsing

CVE-2026-124439 · Severity: high · CVSS 7.5 · Published 2026-11-08

Scriban is a template engine used in .NET applications to safely render untrusted templates. An attacker who can supply templates to a Scriban-based application can craft malicious templates that trigger an uncatchable crash in the host process, causing a denial of service that affects all users and requests on that server. The vulnerability exists in three unrelated code paths—postfix member chains, array comparison, and object evaluation—that bypass the engine's built-in recursion limits.

Technologies: Scriban, Scriban.Signed. Vendors: Scriban.

Quick answers

Is CVE-2026-124439 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124439 being exploited in the wild.
How severe is CVE-2026-124439?: High severity, with a CVSS score of 7.5, published 8 November 2026.
Which products and versions are affected?: Scriban before 7.5.3; Scriban.Signed before 7.5.3.
Is there a fix for CVE-2026-124439?: Yes: fixed in 7.5.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-124439 attacked?: It is attacked over the network.
Am I affected by CVE-2026-124439?: Check whether you run Scriban or Scriban.Signed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 7.5.3

Technical details

The vulnerability involves three uncontrolled recursion paths in Scriban template parsing and evaluation: postfix chains (member access .a, indexer [0], calls) do not invoke the ExpressionDepthLimit check during AST construction; array comparison via ScriptArray.CompareTo lacks depth limits and cycle detection; and object.eval/object.eval_template bypass RecursiveLimit by parsing without context guards. An attacker supplying a crafted template can trigger a StackOverflowException that terminates the .NET process, as uncaught stack overflows in .NET cannot be recovered from by application code.

Affected products

Scriban Scriban before 7.5.3
Scriban Scriban.Signed before 7.5.3

Timeline

2026-10-24: disclosed
2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.