Description
Scriban before 7.2.0 contains a denial of service vulnerability in the array.insert_at function that allocates unbounded null entries without respecting LoopLimit or LimitToString constraints. Attackers can supply a large index parameter to trigger OutOfMemoryException and crash the host process in under a second.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| scriban | scriban | < 7.2.0 | 7.2.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | scriban | < 7.2.0 | 7.2.0 | GHSA-24c8-4792-22hx |
| NuGet | Scriban.Signed | < 7.2.0 | 7.2.0 | GHSA-24c8-4792-22hx |
References
- GitHub Security Advisory (GHSA-24c8-4792-22hx) vendor-advisory
- VulnCheck Advisory: Scriban before 7.2.0 Denial of Service via array.insert_at third-party-advisory