High priorityDisclosed

Advisory · CVE-2026-124437

Scriban templates can exhaust host memory and CPU through unguarded builtins

Scriban before 7.5.3 contains a resource exhaustion flaw that lets untrusted template authors exhaust memory and CPU because builtins like math.format and recursion guards can be bypassed, rated high at CVSS 8.7 under version 4.0; fixed in 7.5.3.

Advisory published November 8, 2026Independent summary
Vendor
Scriban
Product
Scriban
Identifier / CWE
CVE-2026-124437
CWE-400
Action timing
Immediate
ELI5

Explain it like I’m five

Scriban runs templates that other people write, and it is supposed to cap how much work a template can demand. The caps have holes, so a hostile template can make the host burn memory and CPU until it stalls.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Template supplied

    An untrusted author supplies a template to a Scriban host.

  2. 02Guard bypassed

    Builtins like math.format sidestep the depth and recursion limits.

  3. 03Work multiplies

    Memory and CPU use grow without bound as the template runs.

  4. 04Host stalls

    The hosting process slows or stops serving real work.

What happened

Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust memory and CPU because builtins like math.format, expression depth handling, and recursion guards do not hold under hostile templates. The record rates it high at CVSS 8.7 under version 4.0, with network attack vector, low complexity, no privileges required, and no user interaction.

Template engines that run untrusted input need hard resource limits, and these guards did not hold. The flaw is fixed in Scriban 7.5.3.

What to do

  1. Inventory applications using Scriban, including Scriban.Signed, and record each version.
  2. Upgrade to Scriban 7.5.3 or later.
  3. Until upgraded, restrict which users can supply templates where the deployment allows it.
  4. Monitor host memory and CPU around template rendering.
  5. Verify the deployed version after updating.

Management note

A template author should never be able to take down the host. Treat this as availability work for every service that renders untrusted templates.