CVE-2026-74786 scriban CVE debrief

Who should care

Developers and administrators using Scriban versions prior to 7.0.0 should be aware of this vulnerability and take steps to mitigate it. This includes upgrading to version 7.0.0 or later, restricting template rendering to trusted sources, and implementing memory monitoring and limits for applications using Scriban.

Technical summary

The Scriban library prior to version 7.0.0 contains a denial-of-service vulnerability. The vulnerability arises from the LimitToString safety limit being bypassable. This occurs because ObjectToString resets the per-call length counter (_currentToStringLength) on every top-level call, and StringBuilderOutput enforces no cumulative output-size limit. An attacker who can supply a template can exploit this by rendering a near-limit string repeatedly in a loop. This can lead to the allocation of approximately 1GB of memory, causing an out-of-memory condition that crashes the host application.

Defensive priority

Organizations using Scriban versions prior to 7.0.0 should prioritize upgrading to mitigate potential denial-of-service attacks.

Recommended defensive actions

• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Upgrade to Scriban version 7.0.0 or later

Evidence notes

The CVE-2026-74786 record indicates a denial-of-service vulnerability in Scriban versions prior to 7.0.0. The vulnerability is caused by the LimitToString safety limit being bypassable due to ObjectToString resetting the per-call length counter and StringBuilderOutput enforcing no cumulative output-size limit. An attacker can exploit this by supplying a template that renders a near-limit string repeatedly in a loop, causing an out-of-memory condition.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.