CVE-2026-74787

CVE-2026-74787 is a denial-of-service vulnerability in Scriban's `to_json` function. The function performs recursive serialization without depth limits or circular reference detection. When passed a self-referencing object structure, it exhausts the call stack and triggers a StackOverflowException. In .NET, this is fatal—StackOverflowException cannot be caught by normal exception handling and terminates the process entirely, killing all in-flight requests, background jobs, and connection pools in that process. This makes the blast radius of a single malicious template request far larger than a typical request-level DoS. If you use Scriban in any deployment where templates can receive user-controlled input—whether through CMS content, email templating, configuration-as-code systems, or any API that renders user-submitted templates—treat this as an immediate priority. The `to_json` function provides no configuration options to limit recursion depth, no warnings about self-referencing structures, and no graceful failure mode. It simply recurses until the process dies. Check your codebase for uses of `to_json`. If you find it, verify whether any code path could pass user-controlled objects into it. Even if your current templates are developer-authored, consider the attack surface: what happens if a future feature allows users to provide custom objects, or if a deserialization bug elsewhere in your stack creates unexpected object graphs? The function offers no defenses against these scenarios. Scriban ships an alternative `json_serialize` function in later versions that may have different behavior characteristics—review the documentation to understand the differences. If upgrading isn't immediately feasible, audit every code path that calls `to_json` and treat the presence of user-controlled objects in that path as a security defect. The deeper concern: this vulnerability exists in a convenience API that developers use in good faith. There is no visible security boundary, no configuration knob, and no warning in the documentation that this function can kill your process. This reflects a design philosophy that assumed templates would always be trusted artifacts—a assumption that has been violated repeatedly across virtually every templating engine in widespread use. Treat this CVE as an indicator to audit other Scriban builtins for similar resource-exhaustion patterns.

Reviewed through automated stages and approved by a human before publication.