Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent parser. The parser does not enforce a default expression depth limit (the ExpressionDepthLimit property in ParserOptions defaults to null/disabled), so an attacker who controls template input can supply a deeply nested template (e.g., thousands of nested parentheses or blocks) that exhausts thread stack space and raises a StackOverflowException. Because a StackOverflowException cannot be caught in .NET, this causes immediate, unrecoverable termination of the hosting process, resulting in a denial of service. Applications that process untrusted or user-supplied templates can be exploited remotely without authentication.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-74795 Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent parser. The parser does not enforce a default expression depth limit (t… https://www.cve.org/CVERecord?id=CVE-2026-74795
Post summary
The text provides a brief disclosure of CVE-2026-74795, describing its uncontrolled recursion issue in Scriban before version 6.6.0, without indicating exploits, patches, or active use.
🚨*CVE* CVE-2026-74795 Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent parser. The parser does not enforce a default expression depth limit (t… https://www.cve.org/CVERecord?id=CVE-2026-74795 ----- Traducción: CVE-2026-74795 Scr… https://infoflow.cloud`
Post summary
CVE-2026-74795 is an uncontrolled recursion vulnerability affecting Scriban versions before 6.6.0, occurring in its recursive‑descent parser due to an absent default expression depth limit. No PoC, exploit, or patch information is provided.