CVE-2026-74783

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-74783
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74783.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-74783
Aliases
Published
2026-08-16T13:14:09.444Z
Modified
2026-08-17T03:54:57.592973434Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service
Details

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger an uncatchable StackOverflowException that immediately terminates the host process.

Database specific 
{
    "cwe_ids": [
        "CWE-674"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74783.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/scriban/scriban

Affected ranges

Type
GIT
Repo
https://github.com/scriban/scriban
Events
Introduced
b5ac4bf30459fdc76964e3f751e16f7e96079ea7
Fixed
7fdf19df7db01c5e57888c5cc31e4d05f3d75440
Database specific
Show details 
{
    "source": "DESCRIPTION",
    "extracted_events": [
        {
            "introduced": "6.6.0"
        },
        {
            "fixed": "7.2.0"
        }
    ]
}

Affected versions

6.*
6.6.0
7.*
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74783.json"