High severity7.5NVD Advisory· Published Nov 8, 2026

CVE-2026-124439

Description

Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison lacks depth and cycle checks, and object.eval bypasses RecursiveLimit. Attackers who can supply templates can trigger an uncatchable StackOverflowException that terminates the host process.

Affected products

Scriban/scribanllm-fuzzy
Range: <7.5.3

Patches

Vulnerability mechanics

References

github.com/scriban/scriban/security/advisories/GHSA-mvmw-9jxc-7pr2nvd
www.vulncheck.com/advisories/scriban-before-7.5.3-denial-of-service-via-uncatchable-stackoverflowexceptionnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000