Scriban.Signed (< 7.5.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/scriban.signed--7.5.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 15:31:02 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgScriban: Uncontrolled recursion denial-of-service (CVE-2026-124439)https://feed.craftedsignal.io/briefs/2026-11-scriban-recursion-dos/Sun, 08 Nov 2026 15:31:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-scriban-recursion-dos/Scriban and Scriban.Signed versions prior to 7.5.3 are vulnerable to uncontrolled recursion, allowing an attacker to trigger a process-terminating StackOverflowException via malicious templates.Scriban and Scriban.Signed versions prior to 7.5.3 contain uncontrolled recursion vulnerabilities. Specific flaws include postfix member, indexer, and call chains that bypass the configured ExpressionDepthLimit, as well as missing depth and cycle checks in array comparisons and object.eval calls. Successful exploitation allows an attacker who can supply templates to trigger an uncatchable StackOverflowException, resulting in a denial-of-service by crashing the host process.

Impact

Successful exploitation results in the immediate termination of the host process, leading to a denial-of-service for any application utilizing the affected Scriban template engine.

Recommendation

  • Upgrade Scriban and Scriban.Signed to version 7.5.3 or later.
  • Audit applications that process user-supplied templates to ensure templates originate from trusted sources.
  • Monitor logs for repeated StackOverflowException errors within .NET applications that process user templates.
]]>lowadvisory