💥 Scriban Parser Recursion Can Crash Hosting Processes
Teams exposing Scriban parsing to user-controlled templates should upgrade to 6.6.0 or later promptly. Internet-facing or multi-tenant template services deserve priority because a single malicious template can terminate the process.
CVE-2026-74795 affects Scriban before 6.6.0 and allows deeply nested attacker-controlled templates to exhaust thread stack space because the parser lacks a default expression depth limit. The resulting uncatchable StackOverflowException terminates the hosting process, enabling unauthenticated remote denial of service in applications that process untrusted templates. The vulnerability is HIGH severity with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
♻️ Circular Objects Trigger Fatal Scriban Stack Exhaustion
Applications rendering attacker-influenced objects with Scriban should move to 6.6.0 or later promptly. Prioritize services where users can influence template context objects, since successful exploitation terminates the hosting process.
CVE-2026-74794 affects Scriban before 6.6.0 and stems from an unlimited default ObjectRecursionLimit during object rendering. An attacker able to introduce circular-reference objects into the template context can exhaust stack space and trigger an uncatchable StackOverflowException that terminates the host process. The vulnerability is HIGH severity with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
🧱 Nested Arrays Bypass Scriban Expression Depth Protection
Anyone parsing untrusted Scriban templates should upgrade to 7.0.0 or later with high priority. Existing ExpressionDepthLimit settings are not sufficient protection against this specific parser path.
CVE-2026-74792 affects Scriban versions through 6.6.0 and allows deeply nested array initializers to recurse through a parser path not covered by ExpressionDepthLimit. An attacker supplying input to Template.Parse can trigger an uncatchable StackOverflowException and immediately terminate the process even when the default depth limit is enabled. The vulnerability is HIGH severity with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
🔓 Scriban Template Cache Can Leak Previously Authorized Content
Multi-request and multi-tenant applications that reuse Scriban TemplateContext instances should upgrade to 7.0.0 or later urgently. The risk is highest where template-loader authorization changes between users, requests, or tenants.
CVE-2026-74791 affects Scriban before 7.0.0 because TemplateContext.Reset() does not clear the CachedTemplates dictionary. When contexts are reused with request-dependent template loaders, an attacker may access template content authorized during an earlier render without invoking the loader again. The vulnerability is HIGH severity with CVSS 8.6.
🔗 Read more 🔗
Source: NVD
🚨 Scriban Cache Flaw Breaks MemberFilter Sandbox Boundaries
Patch Scriban deployments to 7.0.0 or later as a priority, especially multi-tenant systems or applications relying on MemberFilter as a security boundary. Treat context reuse across trust boundaries as particularly risky until upgraded.
CVE-2026-74790 affects Scriban before 7.0.0 and results from TypedObjectAccessor being cached by Type without accounting for MemberFilter changes. Reusing a TemplateContext after tightening its filter can expose properties and fields that should be hidden, potentially bypassing sandbox boundaries across requests or tenants. The vulnerability is CRITICAL severity with CVSS 9.1.
🔗 Read more 🔗
Source: NVD
🔥 Scriban Expressions Can Bypass LoopLimit and Exhaust Resources
Services rendering untrusted Scriban templates should upgrade to 7.0.0 or later promptly. Do not rely on LoopLimit alone as a sandbox control on affected releases, particularly for public template-processing endpoints.
CVE-2026-74789 affects Scriban through 6.6.0 because LoopLimit applies to script loops but not expensive iteration performed inside built-in operators and functions. Attacker-controlled templates can therefore drive excessive CPU or memory consumption with a single expression despite a restrictive LoopLimit configuration. The vulnerability is HIGH severity with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
🧠 Scriban Padding Functions Enable Huge Memory Allocations
Upgrade systems accepting untrusted Scriban templates to 7.0.0 or later promptly. Public-facing renderers are the main concern because existing LimitToString settings do not stop the allocation from occurring.
CVE-2026-74788 affects Scriban through 6.6.0 and allows uncontrolled memory allocation through the string.pad_left and string.pad_right template functions. An attacker controlling template input can specify extremely large widths, forcing massive allocations before LimitToString is applied and potentially causing OutOfMemoryException and denial of service. The vulnerability is HIGH severity with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
🚨 Scriban Accessor Bypass Lets Templates Modify Restricted Properties
Applications that expose host objects to untrusted Scriban templates should upgrade to 7.2.2 or later immediately. This is especially urgent where templates interact with security-sensitive, persistent, or shared application objects.
CVE-2026-73061 affects Scriban before 7.2.2 and allows template code to write CLR object properties without enforcing setter visibility. Attackers can modify properties with private, internal, or init-only setters and perform mass assignment against public setters, leaving live host objects altered after rendering. The vulnerability is CRITICAL severity with CVSS 9.8.
🔗 Read more 🔗
Source: NVD
⚙️ Scriban Lazy Sequences Can Sidestep LoopLimit
Users running Scriban 3.0.0 through 7.2.5 should upgrade to a release outside the affected range promptly, particularly when templates are attacker-controlled. LoopLimit does not provide meaningful protection against this path on vulnerable versions.
CVE-2026-73060 affects Scriban versions 3.0.0 through 7.2.5 and is a denial-of-service flaw in the ScriptRange.Multiply operator. Array multiplication involving lazy sequences can bypass LoopLimit and execute billions of uncharged iterations, consuming CPU and garbage-collection resources even when LoopLimit is set to 1. The vulnerability is HIGH severity with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
🖼️ Malicious SVG Dimensions Can Exhaust stoatchat Proxy Memory
Operators running stoatchat proxy services should upgrade to 0.15.0 or later promptly. Prioritize internet-facing deployments because remotely hosted malicious SVGs can be used to amplify memory pressure through concurrent requests.
CVE-2026-73057 affects stoatchat before 0.15.0 and stems from insufficient validation of SVG viewBox dimensions in its proxy endpoint. Attackers can host SVG files with extremely large dimensions and trigger concurrent proxy requests to exhaust memory across replicas, causing denial of service. The vulnerability is HIGH severity with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
🔑 SiYuan API Token Endpoint Allows Unlimited Brute-Force Attempts
SiYuan administrators should upgrade to 3.7.4 or later immediately, especially on remotely reachable installations. Deployments using short or weak custom API tokens face greater brute-force risk.
CVE-2026-73056 affects SiYuan kernel versions before 3.7.4 because API-token authentication through headers or the token query parameter is not covered by CAPTCHA or lockout protections. An unauthenticated remote attacker can make unlimited token guesses and, if successful, obtain full RoleAdministrator access with capabilities including arbitrary file operations and SQL queries. The vulnerability is CRITICAL severity with CVSS 9.8.
🔗 Read more 🔗
Source: NVD
🔐 OpenTofu Static Evaluation Can Expose Sensitive Values
Teams using OpenTofu 1.8.0 through 1.8.2 with static evaluation enabled should upgrade to 1.8.3 or later promptly. Deployments that do not use this opt-in static evaluation behavior are not described as affected by this entry.
CVE-2024-58375 affects OpenTofu versions 1.8.0 through 1.8.2 when users opt into static evaluation of module sources, versions, and backend configurations. Values marked as sensitive can be exposed through these configuration elements instead of being rejected, creating a risk of unintended secret disclosure. The vulnerability is HIGH severity with CVSS 7.5 and is fixed in OpenTofu 1.8.3.
🔗 Read more 🔗
Source: NVD