An unauthenticated attacker can cause a denial of service in Scriban by exploiting uncontrolled recursion via nested array initializers.

This vulnerability is caused by uncontrolled recursion (CWE-674) within the template engine. It is accessible to unauthenticated remote attackers who can provide maliciously crafted input to the application.

The successful exploitation of this vulnerability results in a denial of service, which can lead to significant system downtime and service disruption. With a CVSS score of 7.5, the vulnerability is classified as High severity because it allows for high availability impact without requiring any user interaction or authentication.

Immediate Action: Update the Scriban and Scriban.Signed NuGet packages to version 7.0.0 or later.

Proactive Monitoring: Monitor application logs for repeated crashes or excessive resource consumption patterns that may indicate an attempt to trigger stack overflow conditions.

Compensating Controls: Implement input validation or size limits on template inputs to prevent the processing of deeply nested structures that could trigger recursion errors.

Public Exploit Available: Unknown

Given the high impact on service availability, administrators should prioritize updating the Scriban component to version 7.0.0. Testing the update in a staging environment is recommended to ensure compatibility before full deployment.