High severity7.5NVD Advisory· Published Aug 16, 2026

CVE-2026-74783

Description

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger an uncatchable StackOverflowException that immediately terminates the host process.

Affected products

Scriban/scribanllm-fuzzy
Range: 6.6.0-7.2.0

Patches

Vulnerability mechanics

References

github.com/scriban/scriban/security/advisories/GHSA-6q7j-xr26-3h2cnvd
www.vulncheck.com/advisories/scriban-through-parser-recursion-denial-of-servicenvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000