CVE-2026-73060highCWE-770

Scriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiply

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.7epss 0.4%

probabilidad de explotación

0.4%top 69% de las CVE

explotación observada

noninguna fuente lo reporta

Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged iterations, pinning CPU cores and exhausting garbage collection resources even when LoopLimit is set to 1.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Productos afectados

scriban · scriban

Referencias

https://github.com/scriban/scriban/commit/205ca6a7c2349d3d388bd5f1f7729ee198c0d5e5 https://github.com/scriban/scriban/commit/c3f03bfc912e14b306a01a03e611f606b05f9c33 https://github.com/scriban/scriban/security/advisories/GHSA-89cf-6hmv-8rxm https://www.vulncheck.com/advisories/scriban-through-denial-of-service-via-scriptrange-multiply