CVE-2026-74784 Scriban before 7.2.0 Denial of Service via array.insert_at
Attackers can crash the host process by supplying a large index to array.insert_at, causing an OutOfMemoryException in the Scriban template library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-74784?
CVE-2026-74784 is a high-severity denial of service vulnerability in scriban, published on 16 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Scriban before 7.2.0 contains a denial of service vulnerability in the array.insert_at function that allocates unbounded null entries without respecting LoopLimit or LimitToString constraints. Attackers can supply a large index parameter to trigger OutOfMemoryException and crash the host process in under a second.
Weakness: CWE-770
Which versions are affected by CVE-2026-74784?
4 open source packages ship an affected version, including Scriban.Signed and scriban.
| Package | Affected | Fixed in |
|---|---|---|
Scriban.Signed NuGet | All versions | 7.2.0 |
Scriban.Signed NuGet | All versions | 7.2.0 |
scriban NuGet | All versions | 7.2.0 |
scriban NuGet | All versions | 7.2.0 |
How do I fix CVE-2026-74784?
Upgrade Scriban.Signed to 7.2.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-74784 being exploited?
There is no known exploitation of CVE-2026-74784 in the wild and no public exploit code.
Sources
Also known as GHSA-24c8-4792-22hx, GHSA-wcrg-p6mv-jx2j.