CVE-2026-74789 scriban CVE debrief

Who should care

Developers and administrators using Scriban for template rendering, especially in applications that render attacker-controlled templates and rely on LoopLimit for safe execution, should be aware of this vulnerability and take necessary actions to mitigate the risk.

Technical summary

The Scriban template engine before version 7.0.0 contains a vulnerability where its LoopLimit constraint is not applied to expensive iterations inside built-in operators and functions. This can lead to large CPU or memory consumption through expressions like {{ 1..1000000 | array.size }} or {{ 'A' * 200000000 }}, potentially causing a denial of service. The vulnerability affects versions up to 6.6.0 and can be mitigated by upgrading to version 7.0.0 or later.

Defensive priority

Organizations using Scriban versions before 7.0.0 should prioritize upgrading to mitigate potential denial of service risks from large CPU or memory consumption.

Recommended defensive actions

• Upgrade to Scriban version 7.0.0 or later
• Review and adjust LoopLimit configurations
• Monitor for suspicious template rendering activity
• Implement compensating controls for template execution
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE description indicates that Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and functions. A single expression such as {{ 1..1000000 | array.size }} — or a memory-amplification expression such as {{ 'A' * 200000000 }} — can force large CPU or memory consumption even when LoopLimit is configured to a very small value, resulting in denial of service.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.