CVE-2026-74795 Scriban before 6.6.0 Denial of Service via Uncontrolled Recursion

What is CVE-2026-74795?

CVE-2026-74795 is a high-severity denial of service vulnerability in scriban, published on 16 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent parser. The parser does not enforce a default expression depth limit (the ExpressionDepthLimit property in ParserOptions defaults to null/disabled), so an attacker who controls template input can supply a deeply nested template (e.g., thousands of nested parentheses or blocks) that exhausts thread stack space and raises a StackOverflowException. Because a StackOverflowException cannot be caught in .NET, this causes immediate, unrecoverable termination of the hosting process, resulting in a denial of service. Applications that process untrusted or user-supplied templates can be exploited remotely without authentication.

Weakness: CWE-674

Which versions are affected by CVE-2026-74795?

4 open source packages ship an affected version, including Scriban.Signed and scriban.

How do I fix CVE-2026-74795?

Upgrade Scriban.Signed to 6.6.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-74795 being exploited?

There is no known exploitation of CVE-2026-74795 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-wgh7-7m3c-fx25, GHSA-x4hp-vj3w-6w2m.