CVE-2026-74785

CVE-2026-74785 is a reminder that templating engine DoS vulnerabilities represent a design failure, not an implementation bug. Scriban's LoopLimit feature was added to prevent resource exhaustion from iteration, but it was built around the engine's native loop constructs — not the builtin functions that provide equivalent functionality. Range enumeration via builtins bypasses the limit entirely, allowing attackers to trigger the same resource exhaustion that LoopLimit was designed to prevent. This isn't an isolated flaw. The vulnerability disclosure identified three distinct bypass paths — string multiplication, BigInteger shifts, and range enumeration — all bypassing whatever safety controls existed. This pattern reveals a deeper architectural problem: Scriban's expression evaluation subsystem was never designed with a coherent resource consumption model. Security boundaries were added as layers on top of an architecture optimized for expressiveness, and when those goals conflict, expressiveness consistently wins because the security consequences are speculative while the functional utility is immediate. The severity here is worse than the CVSS 6.5 suggests. Templating engines run in-process by design — a DoS that exhausts memory or CPU kills the host process. In most deployments, that's functionally equivalent to remote code execution. The fix addresses the specific bypass, but the underlying gap persists: builtin functions that behave like loops without respecting loop limits. What you should do: audit any Scriban deployment handling untrusted templates for LoopLimit configuration and verify it accounts for builtin function enumeration paths. More importantly, recognize that templating engines running untrusted input need architectural isolation — hard memory and CPU limits enforced by the host process, not by the engine's own security controls. The class of vulnerability recurs across every engine in this space (ERB, Mako, Jinja2 all have similar histories) because the fundamental tension between expressiveness and sandboxing remains unresolved at the ecosystem level.

Reviewed through automated stages and approved by a human before publication.