CyberRota Analysis
AI-GeneratedVersions of Scriban from 3.0.0 to 7.2.5 are vulnerable to a denial of service attack due to a flaw in the ScriptRange.Multiply operator, which allows attackers to bypass the LoopLimit when using lazy sequences. This can lead to excessive CPU usage and resource exhaustion, potentially crippling affected systems. Organizations utilizing Scriban for template processing should prioritize patching to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged iterations, pinning CPU cores and exhausting garbage collection resources even when LoopLimit is set to 1.