Executive brief
Scriban is a .NET template processing library used to render dynamic content in applications. An attacker can supply deeply nested templates that exhaust the application's thread stack, causing an unrecoverable process crash. Applications that accept user-supplied templates or input can be exploited remotely without authentication, resulting in service outage.
Technical details
The vulnerability is an uncontrolled recursion flaw (CWE-674) in Scriban's recursive-descent parser. The ExpressionDepthLimit property in ParserOptions defaults to null (disabled), allowing unbounded nesting of expressions. An attacker supplies a template with thousands of nested parentheses or blocks; the parser recursively evaluates each layer, consuming thread stack space until a StackOverflowException is triggered. Because .NET StackOverflowException cannot be caught by try-catch blocks, this causes immediate, ungraceful termination of the entire hosting process. The attack requires no authentication and is exploitable remotely if the application processes untrusted templates. The fix is available in version 6.6.0, which enforces a default expression depth limit.
Affected products
- Scriban Scriban before 6.6.0
Timeline
- 2026-03-19: disclosed
- 2026-08-16: advisory