CVE-2026-74789

Name of the Vulnerable Software and Affected Versions Scriban versions prior to 7.0.0

Description The software fails to apply the LoopLimit constraint to expensive iterations performed within built-in operators and functions, applying it only to script loop statements. This allows a single expression to cause excessive CPU or memory consumption, leading to a denial of service. This occurs in applications that render templates controlled by an attacker and rely on LoopLimit for safe execution.

Recommendations Update to version 7.0.0 or later.