A vulnerability in the Scriban templating engine allows unauthenticated attackers to cause a denial of service through uncontrolled recursion.

This vulnerability involves uncontrolled recursion (CWE-674) within the templating engine. The issue is reachable by unauthenticated attackers, allowing them to trigger a stack overflow or resource exhaustion.

The successful exploitation of this vulnerability results in a denial of service, rendering applications using the affected Scriban library unavailable. With a CVSS score of 7.5, this represents a significant availability risk that could disrupt critical business operations dependent on web-based rendering or template processing.

Immediate Action: Update the Scriban or Scriban.Signed NuGet packages to version 7.0.0 or later.

Proactive Monitoring: Review application logs for recurring stack overflow exceptions or sudden spikes in memory usage following template rendering requests.

Compensating Controls: Implement request rate limiting or WAF rules to restrict the size and complexity of input templates submitted to the application.

Public Exploit Available: Unknown.

Given the potential for complete service disruption, organizations should prioritize upgrading the Scriban library. Applying the update to version 7.0.0 is the only definitive way to mitigate this risk.