HIGH 8.7 NVD
CVE-2026-124439
Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, arra
Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison lacks depth and cycle checks, and object.eval bypasses RecursiveLimit. Attackers who can supply templates can trigger an uncatchable StackOverflowException that terminates the host process.
References
- https://github.com/scriban/scriban/security/advisories/GHSA-mvmw-9jxc-7pr2
- https://www.vulncheck.com/advisories/scriban-before-7.5.3-denial-of-service-via-uncatchabl
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.