A vulnerability in the Scriban template engine allows unauthenticated remote attackers to trigger a denial of service condition through resource exhaustion.

This vulnerability is categorized under CWE-770: Allocation of Resources Without Limits or Throttling. It allows an unauthenticated attacker to exhaust system resources by submitting malicious script range multiplication inputs.

The successful exploitation of this vulnerability results in a denial of service, which can render applications utilizing the Scriban engine unresponsive or cause them to crash. Given the CVSS score of 7.5, this high severity flaw poses a significant operational risk to business continuity, particularly for web services relying on template rendering for user-facing content.

Immediate Action: Review the project dependencies and ensure the template engine is updated to a version that implements proper resource limits for script operations.

Proactive Monitoring: Monitor server CPU and memory usage for sudden spikes associated with template parsing or rendering functions.

Compensating Controls: Implement input validation to restrict the size and complexity of template scripts submitted by users to prevent resource exhaustion attacks.

Public Exploit Available: Unknown

Organizations utilizing the Scriban template engine should prioritize auditing their implementation to verify if they are using the affected version range. It is critical to apply updates or implement strict input validation to mitigate the risk of denial of service attacks.