A flaw in the Scriban templating engine allows unauthenticated attackers to bypass loop limits, leading to potential denial of service through resource exhaustion.

This vulnerability involves uncontrolled resource consumption (CWE-400) caused by a bypass of built-in loop limit protections. An unauthenticated attacker can trigger this condition to consume excessive CPU or memory.

Successful exploitation allows attackers to perform a denial of service attack by exhausting server resources. With a CVSS score of 7.5, the vulnerability poses a high threat to the reliability and availability of services that process untrusted templates.

Immediate Action: Update the Scriban or Scriban.Signed NuGet packages to version 7.0.0 or later.

Proactive Monitoring: Monitor CPU usage and request processing times for anomalies that might indicate an infinite loop or resource-heavy execution.

Compensating Controls: Use a WAF to filter out suspicious template syntax or unusually long execution requests before they reach the application engine.

Public Exploit Available: Unknown.

Immediate remediation is required to prevent potential service instability. Organizations must update the Scriban dependency to version 7.0.0 to properly enforce resource limits and prevent this bypass.