Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and functions. As a result, a single expression such as {{ 1..1000000 | array.size }} — or a memory-amplification expression such as {{ 'A' * 200000000 }} — can force large CPU or memory consumption even when LoopLimit is configured to a very small value, resulting in denial of service. Applications that render attacker-controlled templates and rely on LoopLimit for safe execution are affected.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Scriban |
|
No data.
No data.
References
History
Mon, 17 Aug 2026 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Scriban
Scriban scriban |
|
| Vendors & Products |
Scriban
Scriban scriban |
Sun, 16 Aug 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and functions. As a result, a single expression such as {{ 1..1000000 | array.size }} — or a memory-amplification expression such as {{ 'A' * 200000000 }} — can force large CPU or memory consumption even when LoopLimit is configured to a very small value, resulting in denial of service. Applications that render attacker-controlled templates and rely on LoopLimit for safe execution are affected. | |
| Title | Scriban before 7.0.0 LoopLimit Bypass via Built-in Operations | |
| Weaknesses | CWE-400 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published: 2026-08-16T13:14:13.792Z
Updated: 2026-08-17T16:04:43.768Z
Reserved: 2026-08-16T12:56:02.577Z
Link: CVE-2026-74789
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-16T14:16:56.917
Modified: 2026-08-17T16:17:48.590
Link: CVE-2026-74789
Redhat
No data.