CVE-2026-74787 scriban CVE debrief

Who should care

Defenders responsible for .NET applications using Scriban should assess exposure and prioritize remediation. This vulnerability can lead to a denial-of-service condition, and verifying affected versions and remediation steps is crucial.

Why it matters

CVE-2026-74787 is a high-severity vulnerability in Scriban that allows for uncontrolled recursion, potentially leading to a denial-of-service condition. Defenders should assess exposure, prioritize remediation, and verify affected versions.

• Denial-of-service condition due to StackOverflowException
• Potential for exploitation requires verification
• Remediation priority for affected .NET applications
• Verification of affected versions and Scriban updates required

Technical summary

The object.to_json function in Scriban before version 7.0.0 lacks depth limits and circular reference detection, allowing for uncontrolled recursion. This can be exploited by crafting templates with self-referencing objects, leading to a StackOverflowException that terminates the hosting .NET process. The vulnerability has a high CVSS score of 8.7 and is considered a high-severity vulnerability. Defenders should prioritize remediation of this vulnerability, as it can lead to a denial-of-service condition. Affected .NET applications using Scriban should be reviewed for exposure, and remediation steps should be verified from official sources. The CVE record and NVD entry provide details on the vulnerability, but

Defensive priority

Defenders should prioritize remediation of this vulnerability, as it can lead to a denial-of-service condition. Affected .NET applications using Scriban should be reviewed for exposure.

Recommended defensive actions

• Review .NET applications using Scriban for exposure to this vulnerability
• Verify affected versions of Scriban and prioritize remediation
• Monitor for potential exploitation attempts
• Perform a thorough review of the code base for potential vulnerabilities
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. However, the affected versions and remediation steps require verification from the official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.