# scriban (NuGet) vulnerabilities 14 known vulnerabilities (3 critical, 11 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 7.6.1 (Nov 8, 2026): no advisory affects it - Newest unaffected release: 7.6.1 (Nov 8, 2026), the latest release - Releases: 156 since 0.1.0 (May 31, 2016) - Registry: https://www.nuget.org/packages/scriban - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-74795: 0.1.0 to 6.5.8 (6.6.0 is outside it) - CVE-2026-74794: 0.1.0 to 6.5.8 (6.6.0 is outside it) - CVE-2026-74792: 0.1.0 to 6.6.0 (7.0.0 is outside it) - CVE-2026-74791: 0.1.0 to 6.6.0 (7.0.0 is outside it) - CVE-2026-74790: 0.1.0 to 6.6.0 (7.0.0 is outside it) - CVE-2026-74789: 0.1.0 to 6.6.0 (7.0.0 is outside it) - CVE-2026-74788: 0.1.0 to 6.6.0 (7.0.0 is outside it) - CVE-2026-74787: 0.1.0 to 6.6.0 (7.0.0 is outside it) - CVE-2026-74786: 0.1.0 to 6.6.0 (7.0.0 is outside it) - CVE-2026-74785: 0.1.0 to 6.6.0 (7.0.0 is outside it) - CVE-2026-74784: 0.1.0 to 7.1.0 (7.2.0 is outside it) - CVE-2026-74783: 6.6.0 to 7.2.0 (7.2.1 is outside it) - CVE-2026-73062: 3.0.0 to 7.2.0 (7.2.1 is outside it) - CVE-2026-73061: 0.1.0 to 7.2.1 (7.2.2 is outside it) ## Advisories (14) ### [CVE-2026-74795](https://cve.now/CVE-2026-74795): Scriban before 6.6.0 Denial of Service via Uncontrolled Recursion - Severity: High 8.7 - Published: Aug 16, 2026 - Affected: fixed in 6.6.0. - Fixed in 6.6.0 (released Mar 19, 2026, 150 days before disclosure). - The latest release, 7.6.1, is not affected. ### [CVE-2026-74794](https://cve.now/CVE-2026-74794): Scriban before 6.6.0 Denial of Service via Infinite Recursion - Severity: High 8.7 - Published: Aug 16, 2026 - Affected: fixed in 6.6.0. - Fixed in 6.6.0 (released Mar 19, 2026, 150 days before disclosure). - The latest release, 7.6.1, is not affected. ### [CVE-2026-74792](https://cve.now/CVE-2026-74792): Scriban before 7.0.0 Stack Overflow via nested array initializers - Severity: High 8.7 - Published: Aug 16, 2026 - Affected: fixed in 7.0.0. - Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure). - The latest release, 7.6.1, is not affected. ### [CVE-2026-74791](https://cve.now/CVE-2026-74791): Scriban before 7.0.0 Authorization Bypass via Stale Include Cache - Severity: Critical 9.2 - Published: Aug 16, 2026 - Affected: fixed in 7.0.0. - Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure). - The latest release, 7.6.1, is not affected. ### [CVE-2026-74790](https://cve.now/CVE-2026-74790): Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache - Severity: Critical 9.3 - Published: Aug 16, 2026 - Affected: fixed in 7.0.0. - Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure). - The latest release, 7.6.1, is not affected. ### [CVE-2026-74789](https://cve.now/CVE-2026-74789): Scriban before 7.0.0 LoopLimit Bypass via Built-in Operations - Severity: High 8.7 - Published: Aug 16, 2026 - Affected: fixed in 7.0.0. - Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure). - The latest release, 7.6.1, is not affected. ### [CVE-2026-74788](https://cve.now/CVE-2026-74788): Scriban before 7.0.0 Denial of Service via string.pad\_left/pad\_right - Severity: High 8.7 - Published: Aug 16, 2026 - Affected: fixed in 7.0.0. - Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure). - The latest release, 7.6.1, is not affected. ### [CVE-2026-74787](https://cve.now/CVE-2026-74787): Scriban before 7.0.0 Uncontrolled Recursion via object.to\_json - Severity: High 8.7 - Published: Aug 16, 2026 - Affected: fixed in 7.0.0. - Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure). - The latest release, 7.6.1, is not affected. ### [CVE-2026-74786](https://cve.now/CVE-2026-74786): Scriban before 7.0.0 Denial of Service via Unbounded Template Output - Severity: High 7.1 - Published: Aug 16, 2026 - Affected: fixed in 7.0.0. - Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure). - The latest release, 7.6.1, is not affected. ### [CVE-2026-74785](https://cve.now/CVE-2026-74785): Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption - Severity: High 7.1 - Published: Aug 16, 2026 - Affected: fixed in 7.0.0. - Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure). - The latest release, 7.6.1, is not affected. ### [CVE-2026-74784](https://cve.now/CVE-2026-74784): Scriban before 7.2.0 Denial of Service via array.insert\_at - Severity: High 8.7 - Published: Aug 16, 2026 - Affected: fixed in 7.2.0. - Fixed in 7.2.0 (released May 12, 2026, 96 days before disclosure). - The latest release, 7.6.1, is not affected. ### [CVE-2026-74783](https://cve.now/CVE-2026-74783): Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service - Severity: High 8.7 - Published: Aug 16, 2026 - Affected: from 6.6.0, fixed in 7.2.1. - Fixed in 7.2.1 (released May 24, 2026, 84 days before disclosure). - The latest release, 7.6.1, is not affected. ### [CVE-2026-73062](https://cve.now/CVE-2026-73062): Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication - Severity: High 8.7 - Published: Aug 16, 2026 - Affected: from 3.0.0, fixed in 7.2.1. - Fixed in 7.2.1 (released May 24, 2026, 84 days before disclosure). - The latest release, 7.6.1, is not affected. ### [CVE-2026-73061](https://cve.now/CVE-2026-73061): Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor - Severity: Critical 9.3 - Published: Aug 16, 2026 - Affected: fixed in 7.2.2. - Fixed in 7.2.2 (released May 29, 2026, 79 days before disclosure). - The latest release, 7.6.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/nuget/scriban Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.