CVE-2026-74783

Name of the Vulnerable Software and Affected Versions Scriban versions 6.6.0 through 7.2.0

Description An issue exists where the ExpressionDepthLimit guard is not enforced, failing to prevent recursive descent parsing of deeply nested expressions. An attacker can provide templates containing deeply nested parentheses, array initializers, object initializers, or unary operators to trigger an uncatchable StackOverflowException, which results in the immediate termination of the host process.

Recommendations Update Scriban to a version later than 7.2.0.