GHSA-grr9-747v-xvcp: Scriban Denial of Service Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-grr9-747v-xvcp",
  "modified" : "2026-07-06T13:06:27Z",
  "published" : "2026-03-19T21:31:01Z",
  "aliases" : [ ],
  "summary" : "Scriban has an Infinite Recursion during Object Rendering Leads to Stack Overflow and Process Crash (Denial of Service)",
  "details" : "When Scriban renders an object that contains a circular reference, it traverses the object's members infinitely. Because the `ObjectRecursionLimit` property defaults to unlimited, this behavior exhausts the thread's stack space, triggering an uncatchable `StackOverflowException` that immediately terminates the hosting process.\n\nWhen rendering objects (e.g., `{{ obj }}`), the Scriban rendering engine recursively inspects and formats the object's properties. To prevent infinite loops caused by deeply nested or circular data structures, `TemplateContext` contains an `ObjectRecursionLimit` property. \n\nHowever, this property currently defaults to `0` (unlimited). If the data context pushed into the template contains a circular reference, the renderer will recurse indefinitely. This is especially dangerous for web applications that map user-controlled payloads (like JSON) directly to rendering contexts, or for applications that pass ORM objects (like Entity Framework models, which frequently contain circular navigation properties) into the template.\n\n#### Proof of Concept (PoC)\nThe following C# code demonstrates the vulnerability. Executing this will cause an immediate, fatal `StackOverflowException`, bypassing any standard error handling.\n\n```csharp\nusing Scriban;\nusing Scriban.Runtime;\n\nvar template = Template.Parse(\"{{ a }}\");\nvar context = new TemplateContext();\nvar a = new ScriptObject();\n\n// Introduce a cycle\na[\"self\"] = a;\ncontext.PushGlobal(new ScriptObject { { \"a\", a } });\n\ntry {\n  // This crashes the entire process immediately\n  template.Render(context);\n} catch (Exception ex) {\n  // This will never execute because StackOverflowException\n  Console.WriteLine(\"Caught exception: \" + ex.Message);\n}\n```\n\n#### Impact\nThis vulnerability allows a Denial of Service (DoS) attack. If a malicious user can manipulate the data structure passed to the renderer to include a cyclic reference, or if the application passes a complex object graph to an untrusted template, the entire .NET hosting process will crash.\n\n#### Suggested Remediation\nUpdate `TemplateContext.cs` to set `ObjectRecursionLimit` to a safe default, such as `20`.\n\n```csharp\npublic int ObjectRecursionLimit { get; set; } = 20;\n```\nBy implementing this default, circular references will gracefully result in a catchable `ScriptRuntimeException` rather than a fatal process crash.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "NuGet",
      "name" : "scriban"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "6.6.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 6.5.8"
    }
  }, {
    "package" : {
      "ecosystem" : "NuGet",
      "name" : "Scriban.Signed"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "6.6.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 6.5.8"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/scriban/scriban/security/advisories/GHSA-grr9-747v-xvcp"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/scriban/scriban/commit/a6fe6074199e5c04f4d29dc8d8e652b24d33e3e4"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/scriban/scriban"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-674" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-19T21:31:01Z",
    "nvd_published_at" : null
  }
}