Scriban uncontrolled recursion in object rendering leads to DoS

Executive brief

Scriban, a text templating engine for .NET, is vulnerable to a flaw that can crash the entire application. If the engine processes data containing circular references (where an object refers back to itself), it enters an infinite loop that exhausts system memory and shuts down the hosting service. This can be used by attackers to cause a total service outage by providing specially crafted data or templates.

Technical details

A vulnerability in Scriban's rendering engine (CWE-674) exists because the ObjectRecursionLimit property in TemplateContext defaults to 0 (unlimited). When the engine encounters a circular reference in the data context—such as an ORM model with navigation properties or a malicious JSON payload—it recurses infinitely. This exhausts the thread stack, triggering an uncatchable StackOverflowException that terminates the .NET process. The vulnerability can be exploited remotely if an application allows user-controlled data or templates to be processed by the engine. The issue is resolved in version 6.6.0 by setting a safe default recursion limit.

Affected products

• scriban scriban <= 6.5.8
• scriban Scriban.Signed <= 6.5.8

Timeline

• 2026-03-19: disclosed
• 2026-03-19: advisory
• 2026-03-19: patched

References

• https://api.github.com/users/adamus2
• https://github.com/adamus2
• https://api.github.com/users/adamus2/gists%7B/gist_id%7D
• https://api.github.com/users/adamus2/repos
• https://avatars.githubusercontent.com/u/93228314?v=4
• https://api.github.com/users/adamus2/events%7B/privacy%7D