CVE-2026-74792

Name of the Vulnerable Software and Affected Versions Scriban versions prior to 7.0.0

Description An issue exists in the parsing of nested array initializers where deeply nested structures cause recursion through the path (ParseArrayInitializer → ParseExpression → ParseArrayInitializer). This specific path is not monitored by the ExpressionDepthLimit counter. An attacker providing untrusted input to the Template.Parse function can trigger an uncatchable StackOverflowException, which results in the immediate termination of the process.

Recommendations Update Scriban to version 7.0.0 or later.