Cloudanix VulnDB

GHSA-c875-h985-hvrc

High · 7.5

Scriban: Built-in operations bypass LoopLimit and delay cancellation, enabling Denial of Service

CVSS

7.5

EPSS

—

Published

Mar 24, 2026

CISA due date

—

The record

Scriban's `LoopLimit` only applies to script loop statements, not to expensive iteration performed inside operators and builtins. An attacker can submit a single expression such as `{{ 1..1000000 | array.size }}` and force large amounts of CPU work even when `LoopLimit` is set to a very small value.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities