CVE-2026-74786

Name of the Vulnerable Software and Affected Versions Scriban versions prior to 7.0.0

Description A denial-of-service issue exists where the LimitToString safety limit, which defaults to 1MB, can be bypassed. This occurs because the ObjectToString() function resets the per-call length counter currentToStringLength during every top-level call, and StringBuilderOutput does not enforce a cumulative output-size limit. An attacker capable of providing a template can repeatedly render a string near the limit within a loop, potentially allocating approximately 1GB of memory and triggering an out-of-memory condition that crashes the host application.

Recommendations Update to version 7.0.0 or later.