CVE-2026-73060

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73060
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73060.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73060
Aliases
  • GHSA-89cf-6hmv-8rxm
Published
2026-08-16T13:14:07.295Z
Modified
2026-08-19T03:31:02.087896437Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Scriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiply
Details

Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged iterations, pinning CPU cores and exhausting garbage collection resources even when LoopLimit is set to 1.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73060.json"
}
References

Affected packages

Git / github.com/scriban/scriban

Affected ranges

Type
GIT
Repo
https://github.com/scriban/scriban
Events
Introduced
9014ab459103c212f7777c57e8c6c62a890fc032
Fixed
8872919995b8baae3008c2d3be6f0fad04e812ac
Fixed
205ca6a7c2349d3d388bd5f1f7729ee198c0d5e5
Fixed
c3f03bfc912e14b306a01a03e611f606b05f9c33
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "7.2.5"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0
3.2.0
3.2.1
3.2.2
3.3.0
3.3.1
3.3.2
3.3.3
3.4.0
3.4.1
3.4.2
3.5.0
3.6.0
3.7.0
3.8.0
3.8.1
3.8.2
3.9.0
4.*
4.0.0
4.0.1
4.0.2
4.1.0
5.*
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.12.1
5.2.0
5.3.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.5.0
5.5.1
5.5.2
5.6.0
5.7.0
5.8.0
5.9.0
5.9.1
6.*
6.0.0
6.1.0
6.2.0
6.2.1
6.3.0
6.4.0
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.5.6
6.5.7
6.5.8
6.6.0
7.*
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.1.0
7.2.0
7.2.1
7.2.2
7.2.3
7.2.4
7.2.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73060.json"