CVE-2026-74789
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and functions. As a result, a single expression such as {{ 1..1000000 | array.size }} or a memory-amplification expression such as {{ 'A' * 200000000 }} can force large CPU or memory consumption even when LoopLimit is configured to a very small value, resulting in denial of service.
Risk Assessment
Risk of denial of service in applications rendering attacker-controlled templates and relying on LoopLimit for safe execution.
Recommendation
Update Scriban to version 7.0.0 or later, which extends LoopLimit to iterations in operators and functions.
Original NVD description (English source)
Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and functions. As a result, a single expression such as {{ 1..1000000 | array.size }} — or a memory-amplification expression such as {{ 'A' * 200000000 }} — can force large CPU or memory consumption even when LoopLimit is configured to a very small value, resulting in denial of service. Applications that render attacker-controlled templates and rely on LoopLimit for safe execution are affected.