---
id: "CVE-2026-124439"
page: "https://infrastack.ai/live/CVE-2026-124439"
kind: "vulnerability"
aliases: ["CVE-2026-124439"]
title: "Scriban: crafted templates crash the host process via stack overflow"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dotnet", "package", "scriban", "template-engines"]
not_affected_if: ["fixed-templates-only", "no-untrusted-input"]
published_at: "2026-11-08T14:18:10+00:00"
first_seen_at: "2026-11-08T14:48:39+00:00"
updated_at: "2026-11-08T14:49:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124439", "first_seen_at": "2026-11-08T14:48:39+00:00"}]
exploit_sources: []
---

# Scriban: crafted templates crash the host process via stack overflow

Link for people: https://infrastack.ai/live/CVE-2026-124439 (this .md is for agents)

Scriban is a .NET template engine, and before version 7.5.3 several recursion checks can be bypassed. An attacker who can supply a template can trigger an uncatchable stack overflow that terminates the whole host process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Scriban and Scriban.Signed package versions in your .NET project files (for example `Scriban` and `Scriban.Signed` entries in the `.csproj` or `packages.lock.json`).
- Look for places where user-supplied text is passed to Scriban as a template.

## Fix

- Scriban and Scriban.Signed: move to `7.5.3` or later.

## Timeline

- 2026-11-08T14:48:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124439

## Documents

- [advisory] Vendor advisory: github.com https://github.com/scriban/scriban/security/advisories/GHSA-mvmw-9jxc-7pr2
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/scriban-before-7.5.3-denial-of-service-via-uncatchable-stackoverflowexception

## From the sources

Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison lacks depth and cycle checks, and object.eval bypasses RecursiveLimit. Attackers who can supply templates can trigger an uncatchable StackOverflowException that terminates the host process.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_