Executive brief
Scriban, a text templating engine for .NET, contains a vulnerability that allows users to bypass safety limits designed to prevent excessive resource use. By submitting specially crafted templates, an attacker can force the server to perform massive amounts of calculation or memory allocation, leading to a denial-of-service (DoS) condition. This is particularly critical for multi-tenant systems or applications that allow users to provide their own templates, such as email or CMS platforms.
Technical details
A vulnerability in Scriban's resource management allows built-in operations and operators to bypass the 'LoopLimit' safety configuration. While 'LoopLimit' is enforced during script loop statements via 'TemplateContext.StepLoop()', internal iterations within built-ins (like 'array.size' on a range) and operators (like string multiplication) do not check this limit. For example, a range expression like '1..1000000' creates a 'ScriptRange' that yields elements without triggering loop step checks, and string multiplication performs allocations in a standard 'for' loop. An attacker can exploit this by providing a template with a single expression that triggers massive CPU or memory usage, causing a Denial of Service. The issue is addressed in version 7.0.0.
Affected products
- scriban Scriban < 7.0.0
- scriban Scriban.Signed < 7.0.0
Timeline
- 2026-03-22: disclosed: Initial disclosure by reporter Zwique
- 2026-03-24: advisory: GitHub Advisory GHSA-c875-h985-hvrc published
- 2026-03-24: patched: Fixed in version 7.0.0