GHSA-xcx6-vp38-8hr5
High · 7.5Scriban has Uncontrolled Recursion in `object.to_json` Causing Unrecoverable Process Crash via StackOverflowException
CVSS
7.5
EPSS
—
Published
Mar 24, 2026
CISA due date
—
The record
The `object.to_json` builtin function in Scriban performs recursive JSON serialization via an internal `WriteValue()` static local function that has no depth limit, no circular reference detection, and no stack overflow guard. A Scriban template containing a self-referencing object passed to `object.to_json` triggers unbounded recursion, causing a `StackOverflowException` that terminates the hosting .NET process. This is a fatal, unrecoverable crash — `StackOverflowException` cannot be caught by user code in .NET.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-92822 A flaw was found in libmodulemd. CWE-674
- CVE-2026-112895 Pillow is a Python imaging library. CWE-674
- CVE-2026-100354 kin-openapi is a Go project for handling OpenAPI files. CWE-674
- CVE-2026-109267 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL… CWE-674
- CVE-2026-109264 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in… CWE-674
- CVE-2026-107678 FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in… CWE-674
- CVE-2026-107208 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-674
- CVE-2026-106572 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-674