Executive brief
Scriban is a fast and powerful scripting language and engine for .NET. A vulnerability in its JSON serialization function allows a malicious template to trigger an unrecoverable crash of the entire application process. This can lead to a complete service outage for any platform using Scriban to process user-provided templates, such as CMS platforms or email generators.
Technical details
The `object.to_json` builtin function in Scriban is vulnerable to uncontrolled recursion (CWE-674). The internal `WriteValue()` function in `ObjectFunctions.cs` lacks depth limits, circular reference detection, and stack overflow guards. An attacker can provide a template with a self-referencing object or a deeply nested structure that, when passed to `object.to_json`, triggers a `StackOverflowException`. In .NET, this exception is fatal and cannot be caught by application code, resulting in a complete process termination. The vulnerability is reachable via any network-facing application that renders user-supplied Scriban templates. The issue is fixed in version 7.0.0 by implementing recursion depth checks and stack safety nets.
Affected products
- Scriban Scriban < 7.0.0
- Scriban Scriban.Signed < 7.0.0
Timeline
- 2026-03-22: disclosed
- 2026-03-24: advisory: GitHub Advisory published
- 2026-03-24: patched: Version 7.0.0 released