Executive brief
Scriban is a template engine used to generate text or web content. A vulnerability in its string padding functions allows an attacker to crash the application by sending a specially crafted, very small request that forces the server to consume massive amounts of memory. This can lead to a complete service outage for any application that processes untrusted templates.
Technical details
The vulnerability is a resource exhaustion issue (CWE-770) within the `StringFunctions.PadLeft` and `StringFunctions.PadRight` methods in `src/Scriban/Functions/StringFunctions.cs`. These methods delegate directly to .NET's native string padding functions without validating the `width` parameter. Because the allocation occurs during the function execution rather than during final rendering, existing `TemplateContext.LimitToString` protections are bypassed. An unauthenticated remote attacker can provide a small template (e.g., 39 bytes) that requests a massive padding width, causing the .NET runtime to attempt a ~1GB allocation per request. This was addressed in version 7.0.0 by introducing width validation.
Affected products
- Scriban Scriban < 7.0.0
- Scriban Scriban.Signed < 7.0.0
Timeline
- 2026-03-24: advisory: GitHub Advisory GHSA-v66j-x4hw-fv9g published.
- 2026-03-24: patched: Fix released in version 7.0.0.