PT-2026-30294 · Nuget · Scriban

Published 2026-03-24 · Updated 2026-03-24

OSV

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

StackOverflowException via nested array initializers bypasses ExpressionDepthLimit fix (GHSA-wgh7-7m3c-fx25)

Details

The recent fix for GHSA-wgh7-7m3c-fx25 (uncontrolled recursion in parser) added ExpressionDepthLimit defaulting to 250. However, deeply nested array initializers ([[[[...) recurse through ParseArrayInitializer → ParseExpression → ParseArrayInitializer, which is a different recursion path not covered by the expression depth counter.

This causes a StackOverflowException on current main (commit b5ac4bf - "Add limits for default safety").

PoC

using Scriban;

// ExpressionDepthLimit (default 250) does NOT prevent this crash
string nested = "{{ " + new string('[', 5000) + "1" + new string(']', 5000) + " }}";
Template.Parse(nested); // StackOverflowException - process terminates

Impact

Same as GHSA-wgh7-7m3c-fx25: High severity. StackOverflowException cannot be caught with try/catch in .NET - the process terminates immediately. Any application calling Template.Parse with untrusted input is vulnerable, even with the new default ExpressionDepthLimit enabled.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

GHSA-P6Q4-FGR8-VX4P

Affected Products

Scriban

References · 4

• https://osv.dev/vulnerability/GHSA-p6q4-fgr8-vx4p · Vendor Advisory
• https://github.com/scriban/scriban · Note
• https://github.com/scriban/scriban/security/advisories/GHSA-p6q4-fgr8-vx4p · Note
• https://github.com/advisories/GHSA-wgh7-7m3c-fx25 · Note