Scriban: Uncontrolled recursion denial-of-service (CVE-2026-124439)
Scriban and Scriban.Signed versions prior to 7.5.3 are vulnerable to uncontrolled recursion, allowing an attacker to trigger a process-terminating StackOverflowException via malicious templates.
CVE search metadata
CVE search record: CVE-2026-124439. Severity: high. CVSS: 7.5. KEV: no. Product: Scriban (< 7.5.3), Scriban.Signed (< 7.5.3). Brief: Scriban: Uncontrolled recursion denial-of-service (CVE-2026-124439). Brief link: https://feed.craftedsignal.io/briefs/2026-11-scriban-recursion-dos/
Triage facts
Revision 1- Applicability
- Scriban (< 7.5.3), Scriban.Signed (< 7.5.3)
- Evidence
- Unknown
- Severity
- Low
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 8, 15:31 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Scriban and Scriban.Signed versions prior to 7.5.3 contain uncontrolled recursion vulnerabilities. Specific flaws include postfix member, indexer, and call chains that bypass the configured ExpressionDepthLimit, as well as missing depth and cycle checks in array comparisons and object.eval calls. Successful exploitation allows an attacker who can supply templates to trigger an uncatchable StackOverflowException, resulting in a denial-of-service by crashing the host process.
Impact
Successful exploitation results in the immediate termination of the host process, leading to a denial-of-service for any application utilizing the affected Scriban template engine.
Recommendation
- Upgrade Scriban and Scriban.Signed to version 7.5.3 or later.
- Audit applications that process user-supplied templates to ensure templates originate from trusted sources.
- Monitor logs for repeated
StackOverflowExceptionerrors within .NET applications that process user templates.
Immediate actions
Patch Scriban and Scriban.Signed to 7.5.3 or later across all internal applications.
Threat Hunt
Identify .NET applications utilizing the Scriban library and monitor for process crashes or recurring StackOverflowExceptions.
Data: Application error logs (e.g., Windows Event Log / Event ID 1000), Application performance monitoring (APM) crash reports
Mitigations
Upgrade Scriban/Scriban.Signed to version 7.5.3.
CVE-2026-124439