Scriban uncontrolled recursion in nested array initializers

Executive brief

Scriban, a text templating library for .NET, is vulnerable to a denial-of-service attack. An attacker can provide a specially crafted template with deeply nested array initializers that causes the application to crash immediately. This crash cannot be prevented by standard error handling, potentially leading to service outages for any application processing untrusted user input through this library.

Technical details

The vulnerability is an uncontrolled recursion (CWE-674) in the Scriban parser. While a previous fix introduced an 'ExpressionDepthLimit', it failed to account for the recursion path between 'ParseArrayInitializer' and 'ParseExpression'. An attacker can exploit this by submitting a template containing deeply nested array initializers (e.g., thousands of open brackets), which exhausts the stack and triggers a 'StackOverflowException'. In .NET, this exception is typically unrecoverable and terminates the process. The issue is resolved in version 7.0.0.

Affected products

• Scriban Scriban < 7.0.0
• Scriban Scriban.Signed < 7.0.0

Timeline

• 2026-03-22: disclosed: Initial disclosure by reporter
• 2026-03-24: advisory: GitHub Advisory published
• 2026-03-24: patched: Version 7.0.0 released

References

• https://api.github.com/users/pawlos
• https://github.com/pawlos
• https://api.github.com/users/pawlos/gists%7B/gist_id%7D
• https://api.github.com/users/pawlos/repos
• https://avatars.githubusercontent.com/u/1296768?v=4
• https://api.github.com/users/pawlos/events%7B/privacy%7D