CVE-2026-74786

CVE-2026-74786 is a memory exhaustion vulnerability in Scriban's template rendering that exploits a fundamental architectural mismatch: a per-call recursion guard composed with an unbounded output accumulator. The `LimitToString` counter (approximately 1MB) was implemented to prevent stack overflow from deeply nested object serialization — a legitimate concern for accidental infinite recursion. However, `StringBuilderOutput` was designed as a passive output sink with no awareness of cumulative allocation limits. When templates provide first-class control flow (loops calling functions that produce large strings), the per-call counter resets on every iteration, making the 1MB limit a recursion-depth proxy rather than a true output budget. The vulnerability exists because the per-call counter was always structurally incapable of enforcing a cumulative invariant. An attacker could bypass even a non-resetting counter by concatenating strings within a single call, staying under 1MB per conversion while accumulating unbounded memory across iterations. The reset behavior is the proximate cause, but the underlying condition is the absence of a true cumulative output limit. For defenders: audit any endpoint that accepts Scriban templates from untrusted sources — this includes email systems, CMS renderers, CI/CD pipelines, and code generation tools. The attack surface exists wherever users supply template logic, not just data. Treat any unpatched Scriban deployment as vulnerable to OOM conditions. On the fix: the proper enforcement point is the output sink level (`StringBuilderOutput`), not the object converter. Tracking cumulative allocation belongs where the actual memory decision is made. A fix in `ObjectToString` alone would be insufficient — the converter should not need to track cross-call state. The template evaluation boundary is where cumulative budgets belong, because that's where attacker intent becomes the unit of trust.

Reviewed through automated stages and approved by a human before publication.