CyberRota Analysis
AI-GeneratedScriban versions prior to 7.0.0 are vulnerable to multiple denial-of-service vulnerabilities in expression evaluation, allowing attackers to exploit unbounded string multiplication, uncontrolled BigInteger shifts, and LoopLimit bypasses. These vulnerabilities can lead to out-of-memory exceptions or CPU exhaustion, potentially crashing the host process. Organizations using Scriban for template processing should prioritize upgrading to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attackers who can supply templates can cause out-of-memory exceptions or CPU exhaustion, typically terminating the entire host process.