Scriban is vulnerable to a denial of service attack where an unauthenticated remote attacker can trigger infinite recursion, leading to resource exhaustion.

The software fails to properly handle recursive calls (CWE-674), allowing an unauthenticated attacker to inject input that causes the engine to enter an infinite loop.

Exploitation of this flaw causes the application process to consume excessive CPU or memory, resulting in a denial of service for legitimate users. The 7.5 CVSS score reflects the high severity of this availability impact, which can severely disrupt business operations relying on the Scriban template engine.

Immediate Action: Update the Scriban and Scriban.Signed NuGet packages to version 6.6.0 or later.

Proactive Monitoring: Review system performance metrics for unexpected spikes in CPU usage or thread counts associated with the template rendering service.

Compensating Controls: Deploy a Web Application Firewall or application-layer filter to identify and block templates containing suspicious recursive patterns.

Public Exploit Available: Unknown

Immediate remediation is required to maintain system availability. Organizations should verify their current version of Scriban and apply the 6.6.0 patch to eliminate the recursive vulnerability.