CVE-2026-124439 · Package
NO FIX YET · SEE WHAT TO DO
Scriban is a .NET template engine, and before version 7.5.3 several recursion checks can be bypassed. An attacker who can supply a template can trigger an uncatchable stack overflow that terminates the whole host process.
first public Oct 24, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that compile or render Scriban templates from input that users or other outside parties can influence are exposed, because a crafted template can crash the process. Applications that only render fixed templates written by the team are not exposed to outside input this way. unknown whether any specific configuration is required beyond supplying templates.
Not affected if fixed-templates-only, no-untrusted-input
Who cares dotnet, scriban, template-engines
Scriban and Scriban.Signed entries in the .csproj or packages.lock.json).7.5.3 or later.Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison lacks depth and cycle checks, and object.eval bypasses RecursiveLimit. Attackers who can supply templates can trigger an uncatchable StackOverflowException that terminates the host process.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.