CVE-2026-74795

Name of the Vulnerable Software and Affected Versions Scriban versions prior to 6.6.0

Description A recursive-descent parser fails to enforce a default expression depth limit because the ExpressionDepthLimit property in ParserOptions is disabled by default. An attacker providing template input with deeply nested blocks or parentheses can exhaust thread stack space, triggering a StackOverflowException. In the .NET environment, this exception cannot be caught, leading to the immediate and unrecoverable termination of the hosting process and resulting in a denial of service. This issue can be exploited remotely and without authentication in applications that process untrusted or user-supplied templates.

Recommendations Update to version 6.6.0 or later. As a temporary mitigation, manually configure the ExpressionDepthLimit property in ParserOptions to a safe value to restrict template nesting depth.