Is CVE-2026-74795 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-74795 being exploited in the wild.

How severe is CVE-2026-74795?

High severity, with a CVSS score of 7.5, published 16 August 2026.

Which products and versions are affected?

scriban (NuGet) ECOSYSTEM:introduced=0,fixed=6.6.0; Scriban.Signed (NuGet) ECOSYSTEM:introduced=0,fixed=6.6.0.

Is there a fix for CVE-2026-74795?

Yes. scriban (NuGet): upgrade to 6.6.0 or later; Scriban.Signed (NuGet): upgrade to 6.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-74795 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-74795?

Check whether you run scriban (NuGet) or Scriban.Signed (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-74795: Scriban uncontrolled recursion stack overflow in parser

CVE-2026-74795 · Severity: high · CVSS 7.5 · Published 2026-08-16

Scriban is a .NET template processing library used to render dynamic content in applications. An attacker can supply deeply nested templates that exhaust the application's thread stack, causing an unrecoverable process crash. Applications that accept user-supplied templates or input can be exploited remotely without authentication, resulting in service outage.

Technologies: scriban (NuGet), Scriban.Signed (NuGet). Vendors: NuGet.

Quick answers

Is CVE-2026-74795 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-74795 being exploited in the wild.
How severe is CVE-2026-74795?: High severity, with a CVSS score of 7.5, published 16 August 2026.
Which products and versions are affected?: scriban (NuGet) ECOSYSTEM:introduced=0,fixed=6.6.0; Scriban.Signed (NuGet) ECOSYSTEM:introduced=0,fixed=6.6.0.
Is there a fix for CVE-2026-74795?: Yes. scriban (NuGet): upgrade to 6.6.0 or later; Scriban.Signed (NuGet): upgrade to 6.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-74795 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-74795?: Check whether you run scriban (NuGet) or Scriban.Signed (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

scriban (NuGet): upgrade to 6.6.0 or later

dotnet add package scriban --version 6.6.0

Scriban.Signed (NuGet): upgrade to 6.6.0 or later

dotnet add package Scriban.Signed --version 6.6.0

Technical details

The vulnerability is an uncontrolled recursion flaw (CWE-674) in Scriban's recursive-descent parser. The ExpressionDepthLimit property in ParserOptions defaults to null (disabled), allowing unbounded nesting of expressions. An attacker supplies a template with thousands of nested parentheses or blocks; the parser recursively evaluates each layer, consuming thread stack space until a StackOverflowException is triggered. Because .NET StackOverflowException cannot be caught by try-catch blocks, this causes immediate, ungraceful termination of the entire hosting process. The attack requires no authentication and is exploitable remotely if the application processes untrusted templates. The fix is available in version 6.6.0, which enforces a default expression depth limit.

Affected products

Scriban Scriban before 6.6.0

Identifiers

CVE-2026-74795
GHSA-wgh7-7m3c-fx25

Timeline

2026-03-19: disclosed
2026-08-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.