---
id: "CVE-2026-124437"
page: "https://infrastack.ai/live/CVE-2026-124437"
kind: "vulnerability"
aliases: ["CVE-2026-124437"]
title: "Scriban: untrusted templates can exhaust memory and CPU, stalling hosts"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dotnet", "multi-tenant", "package", "scriban", "self-hosted"]
not_affected_if: ["scriban-not-used", "trusted-templates-only"]
published_at: "2026-11-08T14:18:10+00:00"
first_seen_at: "2026-11-08T14:48:38+00:00"
updated_at: "2026-11-08T14:49:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124437", "first_seen_at": "2026-11-08T14:48:38+00:00"}]
exploit_sources: []
---

# Scriban: untrusted templates can exhaust memory and CPU, stalling hosts

Link for people: https://infrastack.ai/live/CVE-2026-124437 (this .md is for agents)

Scriban is a .NET template engine; before 7.5.3 several builtins such as math.format, regex.replace and string.escape skip size and loop limits. A template author can submit a small template that drives memory and CPU use high enough to crash or stall the host.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find the Scriban package version in your .NET project files (look for `Scriban` in the .csproj or packages.lock.json) and check whether it is below `7.5.3`.
- Check whether your application renders templates written by users or tenants you do not fully trust.

## Fix

- Scriban: move to `7.5.3` or later

## Timeline

- 2026-11-08T14:48:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124437

## Documents

- [advisory] Vendor advisory: github.com https://github.com/scriban/scriban/security/advisories/GHSA-95w2-9mjq-6c74
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/scriban-before-7.5.3-denial-of-service-via-unguarded-builtins-and-recursion

## From the sources

Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust memory and CPU because builtins like math.format, regex.replace and string.escape skip the LimitToString allocation guard. Attackers can submit small templates using huge format precision specifiers, shared-structure array comparison, BigInteger multiplication or exponential function recursion that ignore LoopLimit and CancellationToken, crashing or stalling multi-tenant hosts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_