Scriban: Resource exhaustion via template builtins (CVE-2026-124437)

Scriban versions prior to 7.5.3 contain a resource exhaustion vulnerability. Built-in functions, specifically math.format, regex.replace, and string.escape, fail to adhere to the LimitToString allocation guard. By supplying templates with specific structures, such as high-precision specifiers, large array comparisons, or specific mathematical operations, an attacker can bypass LoopLimit and CancellationToken mechanisms. This triggers excessive CPU and memory consumption, leading to potential crashing or stalling of host processes in multi-tenant environments.

Impact

Successful exploitation allows for denial-of-service against the host process, potentially disrupting services for all tenants on the shared host.

Recommendation

• Upgrade Scriban to version 7.5.3 or later immediately to apply the corrected allocation guards.
• Review all user-provided templates for usage of high-precision math functions, regex operations, or complex array manipulations if an immediate upgrade is not feasible.
• Monitor host memory and CPU utilization metrics for application processes utilizing the Scriban library to identify potential resource spikes indicative of template-based exploitation.