Skip to main content
cve.nowby Sazabi
← NuGet
NuGetPackage

scriban

14 known vulnerabilities (3 critical, 11 high), with the versions each affects and the releases that fix them.

Latest release
7.6.1 (Nov 8, 2026): no advisory affects it
Newest unaffected release
7.6.1 (Nov 8, 2026), the latest release
Advisories
14 · 3 critical, 11 high
Releases
156 since 0.1.0 (May 31, 2016)
Registry
NuGet
Releases read
Nov 8, 2026

Version timeline

Show all 14 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 14

  • Scriban before 6.6.0 Denial of Service via Uncontrolled Recursion

    Affected: fixed in 6.6.0.

    Fixed in 6.6.0 (released Mar 19, 2026, 150 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • Scriban before 6.6.0 Denial of Service via Infinite Recursion

    Affected: fixed in 6.6.0.

    Fixed in 6.6.0 (released Mar 19, 2026, 150 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • Scriban before 7.0.0 Stack Overflow via nested array initializers

    Affected: fixed in 7.0.0.

    Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • CVE-2026-74791Critical 9.2

    Scriban before 7.0.0 Authorization Bypass via Stale Include Cache

    Affected: fixed in 7.0.0.

    Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • CVE-2026-74790Critical 9.3

    Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache

    Affected: fixed in 7.0.0.

    Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • Scriban before 7.0.0 LoopLimit Bypass via Built-in Operations

    Affected: fixed in 7.0.0.

    Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • Scriban before 7.0.0 Denial of Service via string.pad_left/pad_right

    Affected: fixed in 7.0.0.

    Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • Scriban before 7.0.0 Uncontrolled Recursion via object.to_json

    Affected: fixed in 7.0.0.

    Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • Scriban before 7.0.0 Denial of Service via Unbounded Template Output

    Affected: fixed in 7.0.0.

    Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption

    Affected: fixed in 7.0.0.

    Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • Scriban before 7.2.0 Denial of Service via array.insert_at

    Affected: fixed in 7.2.0.

    Fixed in 7.2.0 (released May 12, 2026, 96 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service

    Affected: from 6.6.0, fixed in 7.2.1.

    Fixed in 7.2.1 (released May 24, 2026, 84 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication

    Affected: from 3.0.0, fixed in 7.2.1.

    Fixed in 7.2.1 (released May 24, 2026, 84 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • CVE-2026-73061Critical 9.3

    Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor

    Affected: fixed in 7.2.2.

    Fixed in 7.2.2 (released May 29, 2026, 79 days before disclosure).

    The latest release, 7.6.1, is not affected.