Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

scriban — Vulnerabilities & Security Advisories 18

All 18 CVE vulnerabilities found in scriban, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security weaknesses and associated advisories for the Scriban template engine, specifically focusing on injection flaws and improper input validation issues. The collection encompasses vulnerability reports published between the project's initial public release in 2015 and the most recent security updates available as of late 2024. Visitors can utilize this resource to track the vendor's official security advisories over time, analyze the prevalence and characteristics of template injection vulnerabilities within the Scriban ecosystem, or review the complete historical record of security incidents affecting the product. The data presented here is curated from public databases and official release notes to provide a comprehensive overview of the product's security posture without relying on unverified third-party claims. By examining the chronological distribution of these issues, security researchers and developers can identify patterns in how specific weakness classes have been addressed or persist across different versions of the software. This aggregation serves as a centralized reference point for understanding the evolution of security risks in Scriban, enabling more informed decisions regarding dependency management and patching strategies for applications utilizing this templating library. All entries are categorized by their respective weakness types to facilitate efficient filtering and analysis for users with specific security concerns.

Vendor: scriban

CVE ID Title CVSS Severity Published
CVE-2026-124439 Scriban before 7.5.3 Denial of Service via Uncatchable StackOverflowException CWE-674 7.5 High 2026-11-08
CVE-2026-124437 Scriban before 7.5.3 Denial of Service via Unguarded Builtins and Recursion CWE-400 7.5 High 2026-11-08
CVE-2026-124438 Scriban before 7.5.2 Delegate Target Exposure via array.map Member Access CWE-200 7.4 High 2026-11-08
CVE-2026-74795 Scriban before 6.6.0 Denial of Service via Uncontrolled Recursion CWE-674 7.5 High 2026-08-16
CVE-2026-74794 Scriban before 6.6.0 Denial of Service via Infinite Recursion CWE-674 7.5 High 2026-08-16
CVE-2026-74792 Scriban before 7.0.0 Stack Overflow via nested array initializers CWE-674 7.5 High 2026-08-16
CVE-2026-74791 Scriban before 7.0.0 Authorization Bypass via Stale Include Cache CWE-226 8.6 High 2026-08-16
CVE-2026-74790 Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache CWE-693 9.1 Critical 2026-08-16
CVE-2026-74789 Scriban before 7.0.0 LoopLimit Bypass via Built-in Operations CWE-400 7.5 High 2026-08-16
CVE-2026-74788 Scriban before 7.0.0 Denial of Service via string.pad_left/pad_right CWE-770 7.5 High 2026-08-16
CVE-2026-74787 Scriban before 7.0.0 Uncontrolled Recursion via object.to_json CWE-674 7.5 High 2026-08-16
CVE-2026-74786 Scriban before 7.0.0 Denial of Service via Unbounded Template Output CWE-770 6.5 Medium 2026-08-16
CVE-2026-74784 Scriban before 7.2.0 Denial of Service via array.insert_at CWE-770 8.7 High 2026-08-16
CVE-2026-74785 Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption CWE-400 6.5 Medium 2026-08-16
CVE-2026-73062 Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication CWE-770 7.5 High 2026-08-16
CVE-2026-74783 Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service CWE-674 7.5 High 2026-08-16
CVE-2026-73061 Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor CWE-284 9.8 Critical 2026-08-16
CVE-2026-73060 Scriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiply CWE-770 7.5 High 2026-08-16

All 18 known CVE vulnerabilities affecting scriban with full Chinese analysis, references, and POCs where available.