Executive brief
Scriban is a fast, powerful, and lightweight scripting language and engine for .NET. A vulnerability in the 'array.insert_at' function allows an attacker to provide a large index value that causes the server to exhaust its memory. This results in a denial-of-service (DoS) condition that can crash the entire application or web server hosting the templates.
Technical details
The 'ArrayFunctions.InsertAt' function in Scriban contains a tight C# loop that allocates null entries to fill the gap between the current array size and a user-provided index. This loop lacks bounds checking and does not consult safety controls like 'LoopLimit' or 'LimitToString'. An attacker can provide a very large integer as the index parameter via a template, triggering an 'OutOfMemoryException'. Because this exception is often unrecoverable in the .NET runtime, it can terminate the host process. The vulnerability was addressed in version 7.2.0 by adding a context-aware overload that validates the index against 'LoopLimit'.
Affected products
- scriban scriban <= 7.1.0
Timeline
- 2026-05-12: disclosed
- 2026-05-19: advisory: GHSA-24c8-4792-22hx published
- 7.2.0: patched