{"id":"CVE-2026-124439","kind":"vulnerability","aliases":["CVE-2026-124439"],"related":[],"title":"Scriban: crafted templates crash the host process via stack overflow","description":"Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison lacks depth and cycle checks, and object.eval bypasses RecursiveLimit. Attackers who can supply templates can trigger an uncatchable StackOverflowException that terminates the host process.","summary":"Scriban is a .NET template engine, and before version 7.5.3 several recursion checks can be bypassed. An attacker who can supply a template can trigger an uncatchable stack overflow that terminates the whole host process.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dotnet","package","scriban","template-engines"],"not_affected_if":["fixed-templates-only","no-untrusted-input"],"how_to_check":"- Check the Scriban and Scriban.Signed package versions in your .NET project files (for example `Scriban` and `Scriban.Signed` entries in the `.csproj` or `packages.lock.json`).\n- Look for places where user-supplied text is passed to Scriban as a template.","fix":"- Scriban and Scriban.Signed: move to `7.5.3` or later.","status":"open","published_at":"2026-11-08T14:18:10+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","triaged_at":"2026-11-08T14:49:06+00:00","updated_at":"2026-11-08T14:49:06+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T14:49:06Z","model":"claude-haiku-5-5","output":{"fix":"- Scriban and Scriban.Signed: move to `7.5.3` or later.","reach":"unknown","title":"Scriban: crafted templates crash the host process via stack overflow","impact":"medium","summary":"Scriban is a .NET template engine, and before version 7.5.3 several recursion checks can be bypassed. An attacker who can supply a template can trigger an uncatchable stack overflow that terminates the whole host process.","audience":"developers","category":"package","nicknames":[],"who_cares":["dotnet","scriban","template-engines"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker crashes the host process with an uncatchable stack overflow","analyst_note":"","how_to_check":"- Check the Scriban and Scriban.Signed package versions in your .NET project files (for example `Scriban` and `Scriban.Signed` entries in the `.csproj` or `packages.lock.json`).\n- Look for places where user-supplied text is passed to Scriban as a template.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-templates-only","no-untrusted-input"],"who_is_affected":"Applications that compile or render Scriban templates from input that users or other outside parties can influence are exposed, because a crafted template can crash the process. Applications that only render fixed templates written by the team are not exposed to outside input this way. unknown whether any specific configuration is required beyond supplying templates.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000735,"input_tokens":4636,"output_tokens":543,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124439':13A,16A '-2026':12A,15A '7.5.3':32B,62C 'array':77C 'attack':40B,88C 'bypass':38B,75C,86C 'call':73C 'chain':74C 'check':35B,83C 'comparison':78C 'contain':63C 'craft':2A 'crash':4A 'cve':11A,14A 'cycl':82C 'depth':80C 'dotnet':17B 'engin':22B,28B 'expressiondepthlimit':76C 'flaw':66C 'host':6A,56B,101C 'index':71C 'lack':79C 'member':70C 'net':26B 'object.eval':85C 'overflow':10A,51B 'packag':18B 'postfix':69C 'process':7A,57B,102C 'recurs':34B,65C 'recursivelimit':87C 'scriban':1A,19B,23B,58C 'scriban.signed':60C 'sever':33B 'stack':9A,50B 'stackoverflowexcept':97C 'suppli':43B,91C 'templat':3A,21B,27B,45B,92C 'template-engin':20B 'termin':53B,99C 'trigger':47B,94C 'uncatch':49B,96C 'uncontrol':64C 'version':31B 'via':8A 'whole':55B","nicknames":[],"mitigations":[],"who_affected":"Applications that compile or render Scriban templates from input that users or other outside parties can influence are exposed, because a crafted template can crash the process. Applications that only render fixed templates written by the team are not exposed to outside input this way. unknown whether any specific configuration is required beyond supplying templates.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dotnet","high","package","scriban","templateengines"],"campaign_type":null,"search_a":"'-124439':13A,16A '-2026':12A,15A 'craft':2A 'crash':4A 'cve':11A,14A 'host':6A 'overflow':10A 'process':7A 'scriban':1A 'stack':9A 'templat':3A 'via':8A","search_b":"'7.5.3':32B 'attack':40B 'bypass':38B 'check':35B 'dotnet':17B 'engin':22B,28B 'host':56B 'net':26B 'overflow':51B 'packag':18B 'process':57B 'recurs':34B 'scriban':19B,23B 'sever':33B 'stack':50B 'suppli':43B 'templat':21B,27B,45B 'template-engin':20B 'termin':53B 'trigger':47B 'uncatch':49B 'version':31B 'whole':55B","search_c":"'7.5.3':62C 'array':77C 'attack':88C 'bypass':75C,86C 'call':73C 'chain':74C 'check':83C 'comparison':78C 'contain':63C 'cycl':82C 'depth':80C 'expressiondepthlimit':76C 'flaw':66C 'host':101C 'index':71C 'lack':79C 'member':70C 'object.eval':85C 'postfix':69C 'process':102C 'recurs':65C 'recursivelimit':87C 'scriban':58C 'scriban.signed':60C 'stackoverflowexcept':97C 'suppli':91C 'templat':92C 'termin':99C 'trigger':94C 'uncatch':96C 'uncontrol':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-24T09:12:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124439","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124439","severity":null,"published_at":"2026-11-08T14:18:10+00:00","modified_at":"2026-11-08T14:18:10+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","fetched_at":"2026-11-08T14:48:39+00:00","note":null}],"documents":[{"id":102062,"url":"https://github.com/scriban/scriban/security/advisories/GHSA-mvmw-9jxc-7pr2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-24T09:12:52+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102063,"url":"https://www.vulncheck.com/advisories/scriban-before-7.5.3-denial-of-service-via-uncatchable-stackoverflowexception","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}