Advisory · CVE-2026-124439
Scriban templates can crash the host with an uncatchable stack overflow
Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison lacks depth and cycle checks, and object.eval bypasses RecursiveLimit, letting template authors trigger an uncatchable StackOverflowException that terminates the host process, rated high at CVSS 8.7 under version 4.0; fixed in 7.5.3.
- Vendor
- Scriban
- Product
- Scriban
- Identifier / CWE
- CVE-2026-124439
CWE-674 - Action timing
- Immediate
Explain it like I’m five
Scriban is supposed to stop templates from nesting too deeply, like a rule against stacking chairs too high. Several nesting tricks slip past the rule, and the stack of calls grows until the whole process falls over in a way nothing can catch.
- 01Template supplied
An untrusted author supplies a template with deeply chained member, indexer, and call expressions.
- 02Depth limit bypassed
The chains bypass ExpressionDepthLimit and RecursiveLimit.
- 03Recursion grows
Array comparison and object.eval recurse without depth or cycle checks.
- 04Stack overflows
An uncatchable StackOverflowException terminates the host process.
What happened
Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison lacks depth and cycle checks, and object.eval bypasses RecursiveLimit. Attackers who can supply templates can trigger an uncatchable StackOverflowException that terminates the host process. The record rates it high at CVSS 8.7 under version 4.0, with network attack vector, low complexity, no privileges required, and no user interaction.
An uncatchable crash is a denial of service that no error handler can contain, and it takes only a crafted template. The flaw is fixed in Scriban 7.5.3.
What to do
- Inventory applications using Scriban, including Scriban.Signed, and record each version.
- Upgrade to Scriban 7.5.3 or later.
- Until upgraded, restrict which users can supply templates where the deployment allows it.
- Monitor host processes for unexpected terminations around template rendering.
- Verify the deployed version after updating.
Management note
A crash no code can catch is the worst kind of denial of service for a template host. Patch the library rather than trying to screen templates.