CVE-2026-74794Disclosure

LOWCVSS 8.7 · HIGH

Signal is active with 4 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException that terminates the hosting process.

0.5/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-674

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • 4 total mentions across 1 day

Deep dive

Activity timeline4 mentions / 1d
01234Mentions · 2026-08-16: 4Patch / Workaround · 2026-08-16: 1Technical Details · 2026-08-16: 408-16
Signal classification3 categories
Disclosure
250.0%
General
125.0%
Patch
125.0%
Referenced assets4 URLs
Full discourse4 posts
  • CVE@CVEnew
    General

    CVE-2026-74794 Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supp… https://www.cve.org/CVERecord?id=CVE-2026-74794

    Post summary

    The post reports CVE-2026-74794 as an infinite recursion flaw in Scriban prior to v6.6.0, without any PoC, exploit code, patch, or evidence of active exploitation.

    010201.3K
    58.1K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-74794 Infinite Recursion in Scriban Before 6.6.0 Crashes Hosting Process https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-74794

    Post summary

    The snippet announces CVE-2026-74794, describing an infinite recursion bug in Scriban that causes a hosting process crash in versions before 6.6.0. No PoC, exploit, patch, or active exploitation details are provided.

    00010150
    4.1K followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-74794 – Unpatched DoS in Scriban template engine. Infinite recursion via circular refs crashes host process. CVSS 7.5. Update to 6.6.0 or limit recursion. #CVE #infosec #Scriban https://www.valtersit.com/cve/CVE-2026-74794 #CVE #infosec #SysAdmin #cybersecurity #Linux #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #ukraine #spain #ireland #unitedkingdom #canada #finland #estonia #lithuania #ireland #hungary #denmark #norway #malta #mexico

    Post summary

    CVE-2026-74794 is a Denial‑of‑Service flaw in Scriban caused by infinite recursion; a patch to version 6.6.0 or recursion limiting is recommended. The vulnerability carries a CVSS score of 7.5.

    0000064
    1.0K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-74794 Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supp… https://www.cve.org/CVERecord?id=CVE-2026-74794 ----- Traducción: CVE-2026-74794 Scr… https://infoflow.cloud`

    Post summary

    CVE‑2026‑74794 is disclosed as an infinite‑recursion vulnerability in Scriban before v6.6.0; no PoC, exploit, active use or patch information is offered.

    0000031
    99 followersView on X

Explore more