Executive brief
Scriban is a template rendering engine used to dynamically generate content from data in .NET applications. A flaw in its object recursion handling allows attackers to supply circular reference objects that cause the rendering process to enter infinite recursion, exhausting memory and crashing the entire application process with no recovery possible.
Technical details
Scriban contains an uncontrolled recursion vulnerability (CWE-674) in its object rendering pipeline. When the TemplateContext.ObjectRecursionLimit property defaults to 0 (unlimited), the renderer fails to stop traversing circular object references, exhausting the stack and triggering an uncatchable StackOverflowException. An attacker can exploit this by providing circular reference objects (e.g., objects with self-referencing properties) directly to the template context via the data structure passed to Template.Render(). This is particularly dangerous in web applications that map user-supplied JSON or pass ORM objects with circular navigation properties into templates. The vulnerability was fixed in version 6.6.0 by setting ObjectRecursionLimit to a safe default value of 20.
Affected products
- Scriban Scriban before 6.6.0
Timeline
- 2026-03-19: disclosed
- 2026-06-16: patched
- 2026-08-16: advisory