Executive brief
Scriban, a popular text templating engine for .NET, contains vulnerabilities that allow an attacker to crash the application or exhaust its resources. By providing a specially crafted template, an attacker can bypass existing safety limits to cause excessive memory usage or CPU consumption. This can lead to a complete service outage (Denial of Service) for applications that allow users to provide their own templates, such as CMS platforms or reporting tools.
Technical details
Scriban's expression evaluation contains three distinct paths for resource exhaustion: unbounded string multiplication, unbounded BigInteger left-shifting, and LoopLimit bypasses when range iterators are consumed by built-in functions. These issues stem from the fact that internal C# loops and specific mathematical operations do not check the TemplateContext safety limits (LimitToString and LoopLimit). An attacker who can supply a template can trigger OutOfMemoryExceptions or CPU exhaustion, often crashing the entire host process. The vulnerabilities are addressed in version 7.0.0 by introducing explicit checks and caps on these operations.
Affected products
- scriban Scriban < 7.0.0
- scriban Scriban.Signed < 7.0.0
Timeline
- 2026-03-22: disclosed: Vulnerability reported to maintainer
- 2026-03-24: advisory: GitHub Advisory published
- 2026-03-24: patched: Fixed in version 7.0.0