These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-16T14:16:57.590Z and has not been modified since then. CVE-2026-74795 is an uncontrolled recursion vulnerability in Scriban before 6.6.0. The recursive-descent parser does not enforce a default expression depth limit, allowing an attacker to supply deeply nested templates that exhaust thread stack s [truncated]
The CVE-2026-74794 vulnerability in Scriban versions before 6.6.0 allows for a denial-of-service attack via infinite recursion. The ObjectRecursionLimit property defaults to unlimited, enabling attackers to supply circular reference objects to the template context, which can exhaust stack space and trigger an uncatchable StackOverflowException, terminating the hosting process. This vulnerability affects o [truncated]
CVE-2026-74792 is a stack overflow vulnerability in Scriban template engine versions before 7.0.0. The vulnerability is triggered by deeply nested array initializers in untrusted input to Template.Parse, leading to an uncatchable StackOverflowException that terminates the process. This issue affects systems using Scriban for template rendering, particularly those allowing untrusted input. Defenders should [truncated]
Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. This vulnerability enables attackers to access previously authorized template content from earlier renders without triggering TemplateLoader.Load() again. The issue affects Scriban versions before 7.0.0 and can be mitigated by upgrading to [truncated]
The Scriban template engine before version 7.0.0 contains a vulnerability where its LoopLimit constraint is not applied to expensive iterations inside built-in operators and functions. This can lead to large CPU or memory consumption through expressions like {{ 1..1000000 | array.size }} or {{ 'A' * 200000000 }}, potentially causing a denial of service. The vulnerability affects versions up to 6.6.0 and c [truncated]
The Scriban library before version 7.0.0 contains an uncontrolled memory allocation vulnerability in the string.pad_left and string.pad_right template functions. These functions perform no validation on the width parameter before delegating to .NET's String.PadLeft/PadRight methods. An attacker can exploit this vulnerability by supplying an arbitrarily large width value, potentially triggering OutOfMemory [truncated]
CVE-2026-74787 is a high-severity vulnerability in Scriban, a .NET library, that allows for uncontrolled recursion via the object.to_json function. This vulnerability can lead to a StackOverflowException, causing the hosting .NET process to terminate. Defenders should assess exposure, prioritize remediation, and verify affected versions. The vulnerability is caused by a lack of depth limits and circular r [truncated]
The Scriban library prior to version 7.0.0 contains a denial-of-service vulnerability that can be exploited by an attacker who can supply a template. This vulnerability arises from the LimitToString safety limit being bypassable due to ObjectToString resetting the per-call length counter (_currentToStringLength) on every top-level call and StringBuilderOutput enforcing no cumulative output-size limit. An [truncated]
Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. These vulnerabilities can be triggered by attackers who can supply templates, potentially causing out-of-memory excepti [truncated]
The Scriban library before version 7.2.0 is vulnerable to a denial of service (DoS) attack due to an unbounded null entry allocation in the array.insert_at function. This vulnerability can be triggered by supplying a large index parameter, leading to an OutOfMemoryException and causing the host process to crash in under a second. The vulnerability exists because the function does not respect LoopLimit or [truncated]
Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. This vulnerability can lead to a StackOverflowException, potentially allowing attackers to cause a denial-of-service. The affected product is Scriban, a .NET library for building and running templating engines. The vulnerability class is related [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-16T14:16:55.640Z and has not been modified since then. The NVD entry is currently Deferred. Organizations and developers using Scriban versions 3.0.0 through 7.2.5 should be aware of the denial of service vulnerability in the ScriptRange.Multiply operator, which allows attackers to bypass LoopLimit [truncated]
CVE-2026-73062 is a denial-of-service vulnerability affecting Scriban versions 3.0.0 through 7.2.0. The vulnerability is caused by the array multiplication operator allocating memory without enforcing LoopLimit or overflow-safe arithmetic checks, allowing attackers to force multi-gigabyte memory allocations and cause resource exhaustion and availability degradation.
The Scriban library before version 7.2.2 is vulnerable to an access-modifier bypass issue in the TypedObjectAccessor component. This vulnerability allows template code to write to CLR object properties without adhering to setter-visibility checks. Consequently, attackers can modify properties with private, internal, or init-only setters and perform mass assignment on public-setter properties. This can lea [truncated]