Vulnerabilidades do Scriban Scriban
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Scriban Scriban: 2 registro(s), com versões afetadas e correções.
CVE-2026-73062
Alta · 7.5
CWE-770 16/08/2026
Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication
Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. Attackers can supply a large integer multiplier in a template to force multi-gigabyte memory allocations, causing resource exhaustion and availability degradation.
CVE-2026-73061
Crítica · 9.8
CWE-284 16/08/2026
Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor
Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.