CVE-2026-74783 Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service
Attackers can crash the host process by supplying templates with deeply nested expressions, bypassing the depth limit guard.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-74783?
CVE-2026-74783 is a high-severity denial of service vulnerability in scriban, published on 16 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger an uncatchable StackOverflowException that immediately terminates the host process.
Weakness: CWE-674
Which versions are affected by CVE-2026-74783?
4 open source packages ship an affected version, including Scriban and Scriban.Signed.
| Package | Affected | Fixed in |
|---|---|---|
Scriban NuGet | From 6.6.0 | 7.2.1 |
Scriban NuGet | From 6.6.0 | 7.2.1 |
Scriban.Signed NuGet | From 6.6.0 | 7.2.1 |
Scriban.Signed NuGet | From 6.6.0 | 7.2.1 |
How do I fix CVE-2026-74783?
Upgrade Scriban to 7.2.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-74783 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-74783 exists.
Sources
Also known as GHSA-6q7j-xr26-3h2c, GHSA-jg4x-p32p-q6xr.