An unauthenticated denial-of-service vulnerability in the Scriban template engine allows remote attackers to crash applications by exhausting system resources.

The issue is caused by a lack of limits on resource allocation during array insertion operations within the template engine. This allows an unauthenticated attacker to inject specially crafted templates that trigger excessive memory consumption.

With a CVSS score of 8.7, this vulnerability poses a severe risk to service availability. Successful exploitation will likely result in application crashes or severe performance degradation, leading to significant service disruption for any platform relying on the Scriban engine for dynamic content rendering.

Immediate Action: Update the Scriban and Scriban.Signed NuGet packages to version 7.2.0 or later.

Proactive Monitoring: Monitor application resource usage, specifically memory consumption, to detect spikes associated with template processing.

Compensating Controls: Implement input validation on user-supplied templates and apply rate limiting to endpoints that trigger template rendering to mitigate the impact of malicious payloads.

Public Exploit Available: Unknown

Organizations using the Scriban library should prioritize updating to version 7.2.0 to prevent potential denial-of-service attacks. If immediate updates are not feasible, ensure that template submission is restricted to trusted users only.