CVE-2026-124437

Name of the Vulnerable Software and Affected Versions Scriban versions prior to 7.5.3

Description Untrusted template authors can cause resource exhaustion of memory and CPU. This occurs because built-in functions such as math.format, regex.replace, and string.escape bypass the LimitToString allocation guard. Exploitation involves submitting small templates that utilize huge format precision specifiers, shared-structure array comparison, BigInteger multiplication, or exponential function recursion, which ignore LoopLimit and CancellationToken, potentially crashing or stalling multi-tenant hosts.

Recommendations Update to version 7.5.3 or later.