CVE-2026-74794CWE-674

CVE-2026-74794

High · published August 16, 2026

CVSS v3.1

7.5

EPSS

Percentile

41.1

In the wild

Unconfirmed

What it is

Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException that terminates the hosting process.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00488 · 41.1th percentile
Weakness: CWE-674 · Uncontrolled Recursion
Published: 2026-08-16T18:16Z

References (3)

https://github.com/scriban/scriban/security/advisories/GHSA-grr9-747v-xvcp · [email protected]https://www.vulncheck.com/advisories/scriban-before-denial-of-service-via-infinite-recursion · [email protected]https://github.com/scriban/scriban/security/advisories/GHSA-grr9-747v-xvcp · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

16 AUG 13:14Z
Scriban before 6.6.0 Denial of Service via Infinite Recursion
cvelistv5