Scriban Known Vulnerabilities & Fixes
Scriban has 14 known security vulnerabilities in NuGet (.NET). Upgrade to version 7.2.2 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.
Low Immediate Risk
No actively exploited vulnerabilities detected. Monitor and update in your next maintenance window.
Recommended safe version: 7.2.2
Upgrading to 7.2.2 or later resolves all 14 known vulnerabilities in Scriban. Run: dotnet add package Scriban --version 7.2.2
Is Scriban in your project?
Check if you're affected and upgrade to 7.2.2 to stay secure.
Security Summary
- 14 affected version ranges have been identified across these 14 advisories.
- 100% of known issues have a published fixed version.
- Remediation: dotnet add package Scriban
Vulnerabilities
14 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details. First disclosed Mar 19, 2026, most recently Jul 6, 2026 (109 days apart).
| CVE / GHSA | Severity | Affected | Fixed In |
|---|---|---|---|
| CVE-2026-74790 Scriban: Sandbox escape due to TypedObjectAccessorcache bypassing MemberFilter after TemplateContext reuse | CRITICAL | 0.1.0, 0.10.0, 0.11.0, 0.12.0 (+119 more) | 7.0.0 |
| CVE-2026-74791 Scriban has an authorization bypass due to stale include cache surviving TemplateContext.Reset() | HIGH | 0.1.0, 0.10.0, 0.11.0, 0.12.0 (+119 more) | 7.0.0 |
| CVE-2026-74784 Scriban: array.insert_at index parameter DoS bypasses LoopLimit and LimitToString | HIGH | 0.1.0, 0.10.0, 0.11.0, 0.12.0 (+127 more) | 7.2.0 |
| CVE-2026-74787 Scriban has Uncontrolled Recursion in `object.to_json` Causing Unrecoverable Process Crash via StackOverflowException | HIGH | 0.1.0, 0.10.0, 0.11.0, 0.12.0 (+119 more) | 7.0.0 |
| CVE-2026-74788 Scriban: Uncontrolled Memory Allocation via string.pad_left/pad_right Allows Remote Denial of Service | HIGH | 0.1.0, 0.10.0, 0.11.0, 0.12.0 (+119 more) | 7.0.0 |
| CVE-2026-74789 Scriban: Built-in operations bypass LoopLimit and delay cancellation, enabling Denial of Service | HIGH | 0.1.0, 0.10.0, 0.11.0, 0.12.0 (+119 more) | 7.0.0 |
| CVE-2026-74792 Scriban has a Stack Overflow via Nested Array Initializers That Bypass the ExpressionDepthLimit Fix | HIGH | 0.1.0, 0.10.0, 0.11.0, 0.12.0 (+119 more) | 7.0.0 |
| CVE-2026-74794 Scriban has an Infinite Recursion during Object Rendering Leads to Stack Overflow and Process Crash (Denial of Service) | HIGH | 0.1.0, 0.10.0, 0.11.0, 0.12.0 (+118 more) | 6.6.0 |
| CVE-2026-74795 Scriban has Uncontrolled Recursion in Parser Leads to Stack Overflow and Process Crash (Denial of Service) | HIGH | 0.1.0, 0.10.0, 0.11.0, 0.12.0 (+118 more) | 6.6.0 |
| CVE-2026-73061 Scriban: Template Writes to Arbitrary CLR Properties via `TypedObjectAccessor` (Mass Assignment + `private` / `init` / `internal` Setter Bypass) | HIGH | 0.1.0, 0.10.0, 0.11.0, 0.12.0 (+129 more) | 7.2.2 |
| CVE-2026-74783 Scriban: ExpressionDepthLimit guard is non-enforcing — parser-recursion DoS in 6.6.0–7.2.0 (incomplete fix for GHSA-wgh7-7m3c-fx25 / GHSA-p6q4-fgr8-vx4p) | MEDIUM | 6.6.0, 7.0.0, 7.0.1, 7.0.2 (+6 more) | 7.2.1 |
| CVE-2026-73062 Scriban: array * int (ScriptArray<T>.TryEvaluate) bypasses LoopLimit — incomplete fix for GHSA-c875-h985-hvrc, missed sibling of GHSA-24c8-4792-22hx | MEDIUM | 3.0.0, 3.0.1, 3.0.2, 3.0.3 (+74 more) | 7.2.1 |
| CVE-2026-74785 Scriban has Multiple Denial-of-Service Vectors via Unbounded Resource Consumption During Expression Evaluation | MEDIUM | 0.1.0, 0.10.0, 0.11.0, 0.12.0 (+119 more) | 7.0.0 |
| CVE-2026-74786 Scriban: Denial of Service via Unbounded Cumulative Template Output Bypassing LimitToString | MEDIUM | 0.1.0, 0.10.0, 0.11.0, 0.12.0 (+119 more) | 7.0.0 |
About This Data
Vulnerability data for Scriban is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.
CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Related NuGet (.NET) Packages
Other packages in this ecosystem, ranked by shared vulnerabilities where available.
Check Your Dependencies
Scan your project to check if you're using a vulnerable version of Scriban.