CVE-2026-124439

7.5 HIGHpublic exploit available

Published 2026-11-08 · Updated 2026-11-10

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison lacks depth and cycle checks, and object.eval bypasses RecursiveLimit. Attackers who can supply templates can trigger an uncatchable StackOverflowException that terminates the host process.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-674

Public exploit & PoC references

https://github.com/scriban/scriban/security/advisories/GHSA-mvmw-9jxc-7pr2

All references

https://github.com/scriban/scriban/security/advisories/GHSA-mvmw-9jxc-7pr2
https://www.vulncheck.com/advisories/scriban-before-7.5.3-denial-of-service-via-uncatchable-stackoverflowexception

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-100354PoC
MEDIUMCVE-2026-100702PoC
MEDIUMCVE-2026-101180
MEDIUMCVE-2026-102265PoC
HIGHCVE-2026-102276PoC
HIGHCVE-2026-102278PoC
HIGHCVE-2026-102281PoC
MEDIUMCVE-2026-102409

Related by shared AI tags and CWE weakness class. Browse the full archive.