CVE-2026-74786 Scriban before 7.0.0 Denial of Service via Unbounded Template Output
An attacker can cause a denial of service by supplying a malicious template that bypasses output limits, leading to memory exhaustion and application crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-74786?
CVE-2026-74786 is a high-severity denial of service vulnerability in scriban, published on 16 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Scriban before 7.0.0 (affected versions <= 6.6.0) contains a denial-of-service vulnerability in which the LimitToString safety limit (default 1MB) can be bypassed because ObjectToString resets the per-call length counter (_currentToStringLength) on every top-level call and StringBuilderOutput enforces no cumulative output-size limit. An attacker who can supply a template can render a near-limit string repeatedly in a loop, allocating approximately 1GB of memory and causing an out-of-memory condition that crashes the host application.
Weakness: CWE-770
Which versions are affected by CVE-2026-74786?
4 open source packages ship an affected version, including Scriban and Scriban.Signed.
| Package | Affected | Fixed in |
|---|---|---|
Scriban NuGet | All versions | 7.0.0 |
Scriban NuGet | All versions | 7.0.0 |
Scriban.Signed NuGet | All versions | 7.0.0 |
Scriban.Signed NuGet | All versions | 7.0.0 |
How do I fix CVE-2026-74786?
Upgrade Scriban to 7.0.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-74786 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-74786 exists.
Sources
Also known as GHSA-m2p3-hwv5-xpqw, GHSA-w7vg-5328-m33q.