CVE-2026-74788

Name of the Vulnerable Software and Affected Versions Scriban versions prior to 7.0.0

Description An uncontrolled memory allocation issue exists in the string.pad left() and string.pad right() template functions. These functions fail to validate the width parameter before delegating the operation to .NET's String.PadLeft/PadRight. An attacker providing untrusted template input can specify an arbitrarily large width value to trigger massive memory allocations, leading to an OutOfMemoryException and a denial of service. The TemplateContext.LimitToString limit is ineffective in this scenario as it is only enforced after the memory allocation has occurred.

Recommendations Update Scriban to version 7.0.0 or later. As a temporary mitigation, restrict the use of string.pad left() and string.pad right() functions when processing untrusted template input.