An unauthenticated remote attacker can cause a denial of service in Scriban 6.x by exploiting uncontrolled recursion in the template parser.

This vulnerability is identified as CWE-674: Uncontrolled Recursion. The parser fails to limit the depth of recursive calls, allowing an unauthenticated attacker to trigger a stack overflow or resource exhaustion.

Exploitation of this vulnerability causes the application to crash, resulting in a denial of service. The CVSS score of 7.5 underscores the high risk to application availability, which can lead to significant downtime and loss of service for critical business operations.

Immediate Action: Update the NuGet package for Scriban to version 7.2.1 or later to address the recursion depth limitations.

Proactive Monitoring: Review system logs for unexpected application termination or stack trace errors related to parsing operations.

Compensating Controls: Use a Web Application Firewall to inspect and reject template inputs that contain deeply nested or suspicious structures.

Public Exploit Available: Unknown

The severity of this denial of service risk necessitates an immediate update to version 7.2.1. Security teams should ensure that all instances of the Scriban library are updated to the patched version to prevent potential exploitation and maintain system stability.