Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Scriban versions before 7.0.0, including the Scriban.Signed package, can be driven to out-of-memory conditions. The per-object LimitToString check resets on each expression render, so a template that repeatedly outputs large strings can accumulate roughly 1GB of output, and the source says this can crash the host .NET process. An attacker needs to be able to supply a template, such as through a CMS or report feature. Upgrade Scriban and Scriban.Signed to 7.0.0 or later. The source gives no workaround beyond that.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.1 | High | 4.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | CNA (VulnCheck) |
- CISA KEV Not listed.
- EPSS 0.0048, the 41st percentile, on 10 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 15:21 UTC First seen by agentprime
- 31 Oct 2026, 15:21 UTC Confirmed by OSV