Scriban.Signed Known Vulnerabilities & Fixes
Scriban.Signed has 13 known security vulnerabilities in NuGet (.NET). Upgrade to version 7.2.1 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.
Low Immediate Risk
No actively exploited vulnerabilities detected. Monitor and update in your next maintenance window.
Recommended safe version: 7.2.1
Upgrading to 7.2.1 or later resolves all 13 known vulnerabilities in Scriban.Signed. Run: dotnet add package Scriban.Signed --version 7.2.1
Is Scriban.Signed in your project?
Check if you're affected and upgrade to 7.2.1 to stay secure.
Security Summary
- 13 affected version ranges have been identified across these 13 advisories.
- 100% of known issues have a published fixed version.
- Remediation: dotnet add package Scriban.Signed
Vulnerabilities
13 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details. First disclosed Mar 19, 2026, most recently Jun 26, 2026 (99 days apart).
| CVE / GHSA | Severity | Affected | Fixed In |
|---|---|---|---|
| CVE-2026-74790 Scriban: Sandbox escape due to TypedObjectAccessorcache bypassing MemberFilter after TemplateContext reuse | CRITICAL | 0.10.0, 0.11.0, 0.12.0, 0.12.1 (+107 more) | 7.0.0 |
| CVE-2026-74791 Scriban has an authorization bypass due to stale include cache surviving TemplateContext.Reset() | HIGH | 0.10.0, 0.11.0, 0.12.0, 0.12.1 (+107 more) | 7.0.0 |
| CVE-2026-74784 Scriban: array.insert_at index parameter DoS bypasses LoopLimit and LimitToString | HIGH | 0.10.0, 0.11.0, 0.12.0, 0.12.1 (+115 more) | 7.2.0 |
| CVE-2026-74787 Scriban has Uncontrolled Recursion in `object.to_json` Causing Unrecoverable Process Crash via StackOverflowException | HIGH | 0.10.0, 0.11.0, 0.12.0, 0.12.1 (+107 more) | 7.0.0 |
| CVE-2026-74788 Scriban: Uncontrolled Memory Allocation via string.pad_left/pad_right Allows Remote Denial of Service | HIGH | 0.10.0, 0.11.0, 0.12.0, 0.12.1 (+107 more) | 7.0.0 |
| CVE-2026-74789 Scriban: Built-in operations bypass LoopLimit and delay cancellation, enabling Denial of Service | HIGH | 0.10.0, 0.11.0, 0.12.0, 0.12.1 (+107 more) | 7.0.0 |
| CVE-2026-74792 Scriban has a Stack Overflow via Nested Array Initializers That Bypass the ExpressionDepthLimit Fix | HIGH | 0.10.0, 0.11.0, 0.12.0, 0.12.1 (+107 more) | 7.0.0 |
| CVE-2026-74794 Scriban has an Infinite Recursion during Object Rendering Leads to Stack Overflow and Process Crash (Denial of Service) | HIGH | 0.10.0, 0.11.0, 0.12.0, 0.12.1 (+106 more) | 6.6.0 |
| CVE-2026-74795 Scriban has Uncontrolled Recursion in Parser Leads to Stack Overflow and Process Crash (Denial of Service) | HIGH | 0.10.0, 0.11.0, 0.12.0, 0.12.1 (+106 more) | 6.6.0 |
| CVE-2026-74783 Scriban: ExpressionDepthLimit guard is non-enforcing — parser-recursion DoS in 6.6.0–7.2.0 (incomplete fix for GHSA-wgh7-7m3c-fx25 / GHSA-p6q4-fgr8-vx4p) | MEDIUM | 6.6.0, 7.0.0, 7.0.1, 7.0.2 (+6 more) | 7.2.1 |
| CVE-2026-73062 Scriban: array * int (ScriptArray<T>.TryEvaluate) bypasses LoopLimit — incomplete fix for GHSA-c875-h985-hvrc, missed sibling of GHSA-24c8-4792-22hx | MEDIUM | 3.0.0, 3.0.1, 3.0.2, 3.0.3 (+74 more) | 7.2.1 |
| CVE-2026-74785 Scriban has Multiple Denial-of-Service Vectors via Unbounded Resource Consumption During Expression Evaluation | MEDIUM | 0.10.0, 0.11.0, 0.12.0, 0.12.1 (+107 more) | 7.0.0 |
| CVE-2026-74786 Scriban: Denial of Service via Unbounded Cumulative Template Output Bypassing LimitToString | MEDIUM | 0.10.0, 0.11.0, 0.12.0, 0.12.1 (+107 more) | 7.0.0 |
About This Data
Vulnerability data for Scriban.Signed is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.
CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Related NuGet (.NET) Packages
Other packages in this ecosystem, ranked by shared vulnerabilities where available.
Check Your Dependencies
Scan your project to check if you're using a vulnerable version of Scriban.Signed.