CVE-2026-74787

Name of the Vulnerable Software and Affected Versions Scriban versions prior to 7.0.0

Description An uncontrolled recursion issue exists in the object.to json() builtin function due to a lack of depth limits and circular reference detection. An attacker can create templates containing self-referencing objects to trigger unbounded recursion, resulting in a StackOverflowException that crashes the hosting .NET process.

Recommendations Update to version 7.0.0 or later. As a temporary mitigation, avoid using the object.to json() function with untrusted or complex objects.