Scriban Template Engine Fails to Prevent Stack Overflow Attacks

Scriban versions 6.6.0 through 7.2.0 contain a critical flaw in their expression depth limiting mechanism that fails to prevent recursive descent parsing attacks. When an attacker supplies maliciously crafted templates containing deeply nested parentheses, array initializers, object initializers, or unary operators, the parser enters uncontrolled recursion that exhausts the call stack. This results in an uncatchable StackOverflowException that immediately terminates the host process, making it an effective denial-of-service vector. Any application using vulnerable Scriban versions to process untrusted template input—including web applications, report generators, and dynamic content systems—faces immediate availability risk. The vulnerability is particularly dangerous because standard exception handling cannot catch or mitigate the stack overflow, leaving no graceful recovery path once the attack payload is processed.

While this vulnerability does not map to specific MITRE ATT&CK techniques, Casky's Claude-powered analysis would identify the attack pattern as a resource exhaustion technique that practitioners should monitor through template input validation and parser behavior anomalies. A practitioner reviewing Casky findings would observe detection signals around CWE-674 (uncontrolled recursion) patterns: abnormal spikes in CPU and memory consumption during template parsing, repeated parser entry with increasing nesting depths, and process termination events correlated with template processing. Extended reasoning capabilities would help security teams correlate these signals with Scriban versions in use and track which applications accept untrusted template input, enabling prioritized patching and compensating controls like input validation, template sandboxing, and resource limits before upgrading to patched versions beyond 7.2.0.