CVE-2026-124437 · Package
NO FIX YET · SEE WHAT TO DO
Scriban is a .NET template engine; before 7.5.3 several builtins such as math.format, regex.replace and string.escape skip size and loop limits. A template author can submit a small template that drives memory and CPU use high enough to crash or stall the host.
first public Oct 24, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that let untrusted users write Scriban templates and run them on a shared server are exposed, because a small template can make the process run out of memory or CPU. Applications that only render templates written by their own developers, or that do not use Scriban, can skip it.
Not affected if scriban-not-used, trusted-templates-only
Who cares dotnet, multi-tenant, scriban, self-hosted
Scriban in the .csproj or packages.lock.json) and check whether it is below 7.5.3.7.5.3 or laterScriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust memory and CPU because builtins like math.format, regex.replace and string.escape skip the LimitToString allocation guard. Attackers can submit small templates using huge format precision specifiers, shared-structure array comparison, BigInteger multiplication or exponential function recursion that ignore LoopLimit and CancellationToken, crashing or stalling multi-tenant hosts.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.