Uncontrolled Recursion in Scriban Template JSON Serialization

Scriban before version 7.0.0 contains a critical uncontrolled recursion vulnerability in its object.to_json builtin function. The flaw stems from the absence of depth limits and circular reference detection mechanisms, allowing attackers to craft malicious templates containing self-referencing objects that trigger unbounded recursion. When processed, these templates cause a StackOverflowException that fatally terminates the entire .NET hosting process, resulting in a denial of service. This vulnerability affects any application using Scriban for template processing—particularly those accepting user-supplied or untrusted templates—including content management systems, reporting engines, and dynamic configuration processors built on .NET platforms.

While this CVE maps to CWE-674 (Uncontrolled Recursion) rather than specific MITRE ATT&CK techniques, Casky's Claude AI-powered analysis would detect the attack pattern as resource exhaustion leading to service disruption. A practitioner using Casky would identify this vulnerability through detection of: abnormal template processing behavior, recursive function call chains in Scriban template execution logs, and process termination events correlated with template rendering activities. The extended reasoning capability would help security teams trace template sources, identify which applications embed vulnerable Scriban versions, and prioritize remediation by correlating template processing patterns with user inputs or external data sources that could be manipulated to exploit this recursion flaw.