Scriban: Fifteen Recursion, DoS, and Access Control Flaws Disclosed Together
Key findings • Fifteen vulnerabilities disclosed in Scriban on August 16, 2026, impacting versions prior to 7.2.5. • Multiple High and Critical severity flaws related to uncontrolled recursio…
Key findings
- Fifteen vulnerabilities disclosed in Scriban on August 16, 2026, impacting versions prior to 7.2.5.
- Multiple High and Critical severity flaws related to uncontrolled recursion and stack overflows in parsing and object rendering.
- Denial-of-service vulnerabilities arise from unbounded memory allocation and bypasses of safety limits like LoopLimit.
- Access control bypasses in TypedObjectAccessor and template caching issues expose sensitive data and properties.
- Affected versions range widely; urgent updates to patched releases (e.g., 6.6.0, 7.0.0, 7.2.2, 7.2.5) are recommended.
On August 16, 2026, a batch of fifteen vulnerabilities was disclosed in the Scriban templating engine, affecting versions prior to 7.2.5. These vulnerabilities, primarily related to recursion, memory allocation, and access control, pose significant risks including denial of service and potential information exposure. The disclosures highlight critical flaws in Scriban's handling of nested structures, object rendering, and safety limits, necessitating urgent updates for all users.
Several vulnerabilities stem from uncontrolled recursion within Scriban's parser and object rendering mechanisms. CVE-2026-74795 and CVE-2026-74794, both rated High, detail issues in the recursive-descent parser and object rendering respectively, where the absence of default expression depth limits and object recursion limits allows deeply nested or circular structures to exhaust stack space, leading to StackOverflowException and host process termination. Similarly, CVE-2026-74792 describes a stack overflow in nested array initializers, and CVE-2026-74787 points to uncontrolled recursion in the object.to_json function, both bypassing existing depth limits. CVE-2026-74783 further exacerbates this, affecting versions 6.6.0 through 7.2.0 with a non-enforcing ExpressionDepthLimit that fails to prevent stack overflows from deeply nested expressions.
Beyond recursion, other vulnerabilities focus on denial-of-service (DoS) through unbounded memory allocation and bypasses of safety limits. CVE-2026-74789 and CVE-2026-74788 highlight how Scriban's LoopLimit and LimitToString safety features are not applied to all operations, such as built-in functions or string padding, allowing for excessive memory consumption. CVE-2026-74784 details a DoS in array.insert_at that allocates unbounded null entries, crashing the host in seconds. CVE-2026-74785 encompasses three DoS vulnerabilities in expression evaluation, including unbounded string multiplication and bypasses of loop limits. CVE-2026-73062 describes a DoS in the array multiplication operator, capable of multi-gigabyte allocations, and CVE-2026-73060 involves a DoS via array multiplication on lazy sequences, leading to billions of uncharged iterations.
Access control and template caching issues also present significant risks. CVE-2026-74791, a High severity vulnerability, arises from a failure to clear the CachedTemplates dictionary when TemplateContext.Reset() is called. This allows for potential access to previously authorized template content from earlier renders if an attacker can influence ITemplateLoader implementations. A critical vulnerability, CVE-2026-73061 (CVSSv3 9.8), involves an access-modifier bypass in TypedObjectAccessor. This flaw permits template code to write to CLR object properties regardless of their setter visibility (private, internal, init-only), and enables mass assignment on public-setter properties, potentially leading to unauthorized data modification. CVE-2026-74790, a Critical severity flaw, further compounds access control issues by caching TypedObjectAccessor without considering MemberFilter changes, allowing reused contexts to expose hidden members and bypass sandbox restrictions.
The affected versions span a wide range, with fixes distributed across multiple releases. Versions prior to 6.6.0 are affected by CVE-2026-74795 and CVE-2026-74794. Versions prior to 7.0.0 are impacted by CVE-2026-74792, CVE-2026-74791, CVE-2026-74790, CVE-2026-74789, CVE-2026-74788, CVE-2026-74787, CVE-2026-74786, and CVE-2026-74785. Scriban before 7.2.0 is vulnerable to CVE-2026-74784, while versions 6.6.0 through 7.2.0 are affected by CVE-2026-74783. CVE-2026-73062 affects versions 3.0.0 through 7.2.0. Critical vulnerability CVE-2026-73061 is fixed in version 7.2.2, and CVE-2026-73060 is addressed in versions 3.0.0 through 7.2.5. Users are strongly advised to update to the latest available versions to mitigate these risks.
This extensive batch of vulnerabilities underscores the importance of robust security measures in templating engines, particularly concerning recursion depth, memory management, and access control. Developers relying on Scriban should carefully review their usage, update to patched versions, and consider implementing additional input validation and sanitization layers to prevent potential exploitation of these flaws. The wide range of affected versions and the severity of the disclosed issues emphasize the need for proactive security management in software supply chains.