CVE-2026-74783: Scriban: ExpressionDepthLimit guard is non-enforcing , parser-recursion DoS in 6.6.0, 7.2.0 (incomplete fix for GHSA-wgh7-7m3c-fx25 / GHSA-p6

CVE-2026-74783 · Severity: medium · CVSS 4 · Published 2026-06-26

Technologies: Scriban.Signed (NuGet), scriban (NuGet). Vendors: NuGet.

Executive brief

Scriban: ExpressionDepthLimit guard is non-enforcing — parser-recursion DoS in 6.6.0–7.2.0 (incomplete fix for GHSA-wgh7-7m3c-fx25 / GHSA-p6q4-fgr8-vx4p)

Affected products

NuGet Scriban.Signed
NuGet scriban

Related threats

Scriban uncontrolled recursion stack overflow in parser
Scriban infinite recursion in object rendering
Scriban stack overflow in nested array initializer parsing
Scriban authorization bypass via stale include cache
Scriban TypedObjectAccessor cache MemberFilter bypass