CVE-2026-74795 scriban CVE debrief

Who should care

Developers and administrators of applications using Scriban for template processing, especially those handling untrusted or user-supplied input, should be aware of this vulnerability and take immediate action to mitigate the risk. They should verify their Scriban versions, apply patches or upgrades, and implement additional security measures to prevent exploitation.

Technical summary

CVE-2026-74795 is an uncontrolled recursion vulnerability in Scriban before 6.6.0. The recursive-descent parser does not enforce a default expression depth limit, allowing an attacker to supply deeply nested templates that exhaust thread stack space, resulting in a StackOverflowException and immediate process termination. This vulnerability is particularly severe as it can be exploited remotely without authentication in applications processing untrusted or user-supplied templates. Affected applications should prioritize upgrading to Scriban version 6.6.0 or later to mitigate this vulnerability.

Defensive priority

CVE-2026-74795 is rated HIGH with a CVSS score of 8.7; applications using Scriban before 6.6.0 are vulnerable to denial of service via uncontrolled recursion.

Recommended defensive actions

• Inventory and verify Scriban versions used in applications, especially those processing untrusted or user-supplied templates.
• Apply patches or upgrade to Scriban version 6.6.0 or later.
• Implement compensating controls such as input validation and monitoring for suspicious template processing activity.
• Review and update security configurations for .NET applications using Scriban.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE-2026-74795 vulnerability in Scriban before 6.6.0 allows for denial of service via uncontrolled recursion. Details are limited, and verification is recommended. Affected applications using Scriban for template processing, especially those handling untrusted or user-supplied input, should verify their versions and take immediate action to mitigate the risk. The vulnerability can be exploited remotely without authentication, leading to immediate, unrecoverable termination of the hosting process. Evidence of exploitation attempts should be monitored, and additional security measures such as input validation and monitoring for suspicious template processing activity should be considered.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.