Scriban (< 7.5.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/scriban--7.5.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 15:31:02 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgScriban: Uncontrolled recursion denial-of-service (CVE-2026-124439)https://feed.craftedsignal.io/briefs/2026-11-scriban-recursion-dos/Sun, 08 Nov 2026 15:31:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-scriban-recursion-dos/Scriban and Scriban.Signed versions prior to 7.5.3 are vulnerable to uncontrolled recursion, allowing an attacker to trigger a process-terminating StackOverflowException via malicious templates.Scriban and Scriban.Signed versions prior to 7.5.3 contain uncontrolled recursion vulnerabilities. Specific flaws include postfix member, indexer, and call chains that bypass the configured ExpressionDepthLimit, as well as missing depth and cycle checks in array comparisons and object.eval calls. Successful exploitation allows an attacker who can supply templates to trigger an uncatchable StackOverflowException, resulting in a denial-of-service by crashing the host process.

Impact

Successful exploitation results in the immediate termination of the host process, leading to a denial-of-service for any application utilizing the affected Scriban template engine.

Recommendation

  • Upgrade Scriban and Scriban.Signed to version 7.5.3 or later.
  • Audit applications that process user-supplied templates to ensure templates originate from trusted sources.
  • Monitor logs for repeated StackOverflowException errors within .NET applications that process user templates.
]]>lowadvisoryScriban: Resource exhaustion via template builtins (CVE-2026-124437)https://feed.craftedsignal.io/briefs/2026-11-08-scriban-resource-exhaustion/Sun, 08 Nov 2026 15:30:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-08-scriban-resource-exhaustion/Scriban versions prior to 7.5.3 are vulnerable to resource exhaustion because specific built-in functions bypass memory and CPU allocation limits, allowing malicious templates to cause denial-of-service in multi-tenant environments.Scriban versions prior to 7.5.3 contain a resource exhaustion vulnerability. Built-in functions, specifically math.format, regex.replace, and string.escape, fail to adhere to the LimitToString allocation guard. By supplying templates with specific structures, such as high-precision specifiers, large array comparisons, or specific mathematical operations, an attacker can bypass LoopLimit and CancellationToken mechanisms. This triggers excessive CPU and memory consumption, leading to potential crashing or stalling of host processes in multi-tenant environments.

Impact

Successful exploitation allows for denial-of-service against the host process, potentially disrupting services for all tenants on the shared host.

Recommendation

  • Upgrade Scriban to version 7.5.3 or later immediately to apply the corrected allocation guards.
  • Review all user-provided templates for usage of high-precision math functions, regex operations, or complex array manipulations if an immediate upgrade is not feasible.
  • Monitor host memory and CPU utilization metrics for application processes utilizing the Scriban library to identify potential resource spikes indicative of template-based exploitation.
]]>lowadvisory