Scriban denial of service via unbounded cumulative template output

Executive brief

Scriban is a fast and powerful text templating engine for .NET. A vulnerability in how it handles large outputs allows an attacker to bypass safety limits and consume excessive server memory. This can lead to a denial-of-service condition, crashing the entire application and affecting all users.

Technical details

A resource exhaustion vulnerability exists in Scriban due to an improper reset of the '_currentToStringLength' counter in the 'ObjectToString' method. While 'LimitToString' is intended to cap the size of individual objects, the counter resets on every top-level call within a template. An attacker can provide a template that repeatedly renders strings just below the limit (e.g., using a loop), causing the underlying 'StringBuilderOutput' to grow without bound. This leads to an Out-of-Memory (OOM) condition that crashes the host .NET process. The issue is fixed in version 7.0.0 by introducing a cumulative 'OutputLimit'.

Affected products

• Scriban Scriban < 7.0.0
• Scriban Scriban.Signed < 7.0.0

Timeline

• 2026-03-22: disclosed: Advisory published to scriban/scriban repository.
• 2026-03-24: advisory: GitHub Advisory published.
• 2026-07-06: other: Advisory updated.

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D