An unauthenticated remote attacker can exploit uncontrolled recursion in Scriban to cause a denial of service by exhausting system resources.

This vulnerability is classified as uncontrolled recursion (CWE-674), where the parser does not correctly limit the depth of recursive operations, allowing an unauthenticated attacker to crash the application.

The potential for a denial of service poses a high risk to business continuity, as the application becomes unresponsive to legitimate requests. With a CVSS score of 7.5, the vulnerability represents a significant risk to service availability that should be addressed promptly.

Immediate Action: Update the Scriban and Scriban.Signed NuGet packages to version 6.6.0 or later.

Proactive Monitoring: Monitor for application crashes or timeouts that coincide with the submission of complex or large templates.

Compensating Controls: Use resource quotas or execution time limits for template rendering processes to mitigate the impact of potential DoS attempts.

Public Exploit Available: Unknown

Organizations should treat this high-severity vulnerability with urgency. Updating to version 6.6.0 is the necessary step to ensure that the template parser correctly handles nested or recursive structures, thereby preventing the associated denial of service risk.