Scriban uncontrolled memory allocation in array multiplication

Executive brief

Scriban is a high-performance scripting language and template engine for .NET. A vulnerability in how the engine handles array multiplication allows an attacker to force the application to allocate massive amounts of memory using a very small input. This can lead to a denial-of-service (DoS) condition where the application crashes or becomes unresponsive, potentially affecting all users on the system.

Technical details

A denial-of-service vulnerability exists in Scriban's array multiplication operator (`array * integer`). The implementation in `ScriptArray<T>.TryEvaluate` lacks `LoopLimit` or `LimitToString` checks and uses unchecked integer arithmetic for capacity calculation. An attacker providing a crafted template can trigger a multi-gigabyte allocation, leading to an `OutOfMemoryException` or process termination by the OS OOM-killer. This issue represents an incomplete fix for previous DoS hardening (GHSA-c875-h985-hvrc) and a missed sibling of a similar fix in array insertion (GHSA-24c8-4792-22hx). The vulnerability is patched in version 7.2.1.

Affected products

• Scriban Scriban >= 3.0.0, <= 7.2.0

Timeline

• 2026-05-24: disclosed
• 2026-06-26: advisory
• 7.2.1: patched

References

• https://api.github.com/users/MindflareX
• https://github.com/MindflareX
• https://api.github.com/users/MindflareX/gists%7B/gist_id%7D
• https://api.github.com/users/MindflareX/repos
• https://avatars.githubusercontent.com/u/94793217?v=4
• https://api.github.com/users/MindflareX/events%7B/privacy%7D