Cloudanix VulnDB

GHSA-m2p3-hwv5-xpqw

Medium · 6.5

Scriban: Denial of Service via Unbounded Cumulative Template Output Bypassing LimitToString

CVSS

6.5

EPSS

—

Published

Mar 24, 2026

CISA due date

—

The record

The `LimitToString` safety limit (default 1MB since commit `b5ac4bf`) can be bypassed to allocate approximately 1GB of memory by exploiting the per-call reset of `_currentToStringLength` in `ObjectToString`. Each template expression rendered through `TemplateContext.Write(SourceSpan, object)` triggers a separate top-level `ObjectToString` call that resets the length counter to zero, and the underlying `StringBuilderOutput` has no cumulative output size limit. An attacker who can supply a template can cause an out-of-memory condition in the host application.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities