3 results · Clear filters · Feed
-
Medium 6.5
Scriban before 7.0.0 Denial of Service via Unbounded Template Output
Scriban before 7.0.0 (affected versions <= 6.6.0) contains a denial-of-service vulnerability in which the LimitToString safety limit (default 1MB) can be bypassed because ObjectToString resets the per-call length counter (_currentToStringLength) on every top-…
-
Medium 6.5
Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption
Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enum…
-
Medium 5.3
Scriban Affected by Memory Exhaustion (OOM) via Unbounded String Generation (Denial of Service)
`TemplateContext.LimitToString` defaults to `0` (unlimited). While Scriban implements a default `LoopLimit` of 1000, an attacker can still cause massive memory allocation via exponential string growth. Doubling a string for just 30 iterations generates over 1…