CVE-2026-74794: high-severity vulnerability in scriban
Scriban before 6.6.0 Denial of Service via Infinite Recursion
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.5%
Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException that terminates the hosting process.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
scriban · scribanRelated CVEs — scriban
In the same product, most dangerous first.
CVE-2026-74789HIGHScriban before 7.0.0 LoopLimit Bypass via Built-in OperationsEPSS 0.6%CVE-2026-74795HIGHScriban before 6.6.0 Denial of Service via Uncontrolled RecursionEPSS 0.6%CVE-2026-74792HIGHScriban before 7.0.0 Stack Overflow via nested array initializersEPSS 0.5%CVE-2026-74788HIGHScriban before 7.0.0 Denial of Service via string.pad_left/pad_rightEPSS 0.5%CVE-2026-74787HIGHScriban before 7.0.0 Uncontrolled Recursion via object.to_jsonEPSS 0.5%CVE-2026-73062HIGHScriban 3.0.0 through 7.2.0 Denial of Service via Array MultiplicationEPSS 0.5%