Uncontrolled Recursion in Scriban Template Engine

CVE-2026-124439 affects Scriban and Scriban.Signed versions before 7.5.3, exposing a critical flaw in how the template engine handles recursive operations. The vulnerability allows attackers to bypass depth and recursion limits through multiple attack vectors: postfix member access chains, indexer operations, call chains that circumvent ExpressionDepthLimit, array comparisons lacking cycle detection, and object.eval() functions that bypass RecursiveLimit entirely. Any application using Scriban to process untrusted templates becomes a target, as an attacker can supply malicious template code that triggers an uncatchable StackOverflowException, causing immediate denial of service by crashing the host process. This affects developers and organizations relying on Scriban for dynamic content generation, email templating, report generation, or any scenario where user-supplied templates are processed.

While this CVE currently maps to zero Casky skills due to its template engine specificity and lack of established MITRE ATT&CK alignment, practitioners using Casky's Claude AI-powered analysis can detect related attack patterns by examining code execution flows, resource exhaustion tactics, and input validation gaps. Security teams should focus on identifying CWE-674 patterns—uncontrolled recursion—across their codebase through Casky's extended reasoning capabilities to surface similar depth-limit bypass vulnerabilities in custom templating systems. A practitioner reviewing this vulnerability would recognize the attack surface: any endpoint accepting template input, configuration files using Scriban syntax, or dynamic code generation paths. Immediate remediation involves upgrading to Scriban 7.5.3 or later and implementing strict input validation and sandboxing for all template processing operations.