Skip to main content
cve.nowby Sazabi
← NuGet
NuGetPackage

Scriban.Signed

13 known vulnerabilities (2 critical, 11 high), with the versions each affects and the releases that fix them.

Latest release
7.6.1 (Nov 8, 2026): no advisory affects it
Newest unaffected release
7.6.1 (Nov 8, 2026), the latest release
Advisories
13 · 2 critical, 11 high
Releases
144 since 0.9.0 (Oct 25, 2017)
Registry
NuGet
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 13

  • Scriban before 6.6.0 Denial of Service via Uncontrolled Recursion

    Affected: fixed in 6.6.0.

    Fixed in 6.6.0 (released Mar 19, 2026, 150 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • Scriban before 6.6.0 Denial of Service via Infinite Recursion

    Affected: fixed in 6.6.0.

    Fixed in 6.6.0 (released Mar 19, 2026, 150 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • Scriban before 7.0.0 Stack Overflow via nested array initializers

    Affected: fixed in 7.0.0.

    Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • CVE-2026-74791Critical 9.2

    Scriban before 7.0.0 Authorization Bypass via Stale Include Cache

    Affected: fixed in 7.0.0.

    Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • CVE-2026-74790Critical 9.3

    Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache

    Affected: fixed in 7.0.0.

    Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • Scriban before 7.0.0 LoopLimit Bypass via Built-in Operations

    Affected: fixed in 7.0.0.

    Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • Scriban before 7.0.0 Denial of Service via string.pad_left/pad_right

    Affected: fixed in 7.0.0.

    Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • Scriban before 7.0.0 Uncontrolled Recursion via object.to_json

    Affected: fixed in 7.0.0.

    Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • Scriban before 7.0.0 Denial of Service via Unbounded Template Output

    Affected: fixed in 7.0.0.

    Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption

    Affected: fixed in 7.0.0.

    Fixed in 7.0.0 (released Mar 22, 2026, 147 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • Scriban before 7.2.0 Denial of Service via array.insert_at

    Affected: fixed in 7.2.0.

    Fixed in 7.2.0 (released May 12, 2026, 96 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service

    Affected: from 6.6.0, fixed in 7.2.1.

    Fixed in 7.2.1 (released May 24, 2026, 84 days before disclosure).

    The latest release, 7.6.1, is not affected.

  • Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication

    Affected: from 3.0.0, fixed in 7.2.1.

    Fixed in 7.2.1 (released May 24, 2026, 84 days before disclosure).

    The latest release, 7.6.1, is not affected.