CVE-2026-124437 Scriban before 7.5.3 Denial of Service via Unguarded Builtins and Recursion
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124437?
CVE-2026-124437 is a high-severity vulnerability in scriban, published on 8 Nov 2026.
Official description
Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust memory and CPU because builtins like math.format, regex.replace and string.escape skip the LimitToString allocation guard. Attackers can submit small templates using huge format precision specifiers, shared-structure array comparison, BigInteger multiplication or exponential function recursion that ignore LoopLimit and CancellationToken, crashing or stalling multi-tenant hosts.
Weakness: CWE-400
Which versions are affected by CVE-2026-124437?
How do I fix CVE-2026-124437?
No fix has been published for CVE-2026-124437 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124437 being exploited?
There is no known exploitation of CVE-2026-124437 in the wild and no public exploit code.
Sources
Also known as GHSA-33xx-p3r3-5jv7, GHSA-95w2-9mjq-6c74.