Scriban stack overflow via non-enforcing parser depth limit

Executive brief

Scriban, a text processing and templating library for .NET, contains a flaw that allows an attacker to crash the entire application. By providing a specially crafted, deeply nested template, an attacker can trigger a stack overflow that the application cannot recover from, leading to an immediate shutdown. This affects any service that processes user-provided templates or uses certain dynamic evaluation functions.

Technical details

The Scriban expression parser (used for both native and Liquid syntax) implements an `ExpressionDepthLimit` that only logs a non-fatal error rather than halting recursion. An attacker can provide a template with deeply nested parentheses, array initializers, or unary operators (approximately 8KB in size) to exhaust the native thread stack. This results in an uncatchable `StackOverflowException` in .NET, terminating the host process. The vulnerability also affects `object.eval` and `object.eval_template` functions, which re-parse strings at runtime. This is an incomplete fix for previous advisories GHSA-wgh7-7m3c-fx25 and GHSA-p6q4-fgr8-vx4p. A fix is available in version 7.2.1.

Affected products

• Scriban Scriban >= 6.6.0, <= 7.2.0

Timeline

• 2026-05-24: advisory: Initial GitHub Advisory published
• 2026-06-26: patched: Updated advisory noting version 7.2.1 as patched

References

• https://api.github.com/users/MindflareX
• https://github.com/MindflareX
• https://api.github.com/users/MindflareX/gists%7B/gist_id%7D
• https://api.github.com/users/MindflareX/repos
• https://avatars.githubusercontent.com/u/94793217?v=4
• https://api.github.com/users/MindflareX/events%7B/privacy%7D