CVE-2026-74787 Scriban before 7.0.0 Uncontrolled Recursion via object.to_json
Attackers can cause a denial of service by crafting templates with self-referencing objects to trigger unbounded recursion in the Scriban library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-74787?
CVE-2026-74787 is a high-severity denial of service vulnerability in scriban, published on 16 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.to_json builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverflowException that fatally terminates the hosting .NET process.
Weakness: CWE-674
Which versions are affected by CVE-2026-74787?
4 open source packages ship an affected version, including Scriban and Scriban.Signed.
| Package | Affected | Fixed in |
|---|---|---|
Scriban NuGet | All versions | 7.0.0 |
Scriban NuGet | All versions | 7.0.0 |
Scriban.Signed NuGet | All versions | 7.0.0 |
Scriban.Signed NuGet | All versions | 7.0.0 |
How do I fix CVE-2026-74787?
Upgrade Scriban to 7.0.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-74787 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-74787 exists.
Sources
Also known as GHSA-mmv3-xfv2-gq73, GHSA-xcx6-vp38-8hr5.