CVE-2026-124437: Scriban before 7.5.3 Denial of Service via Unguarded Builtins and Recursion
Fixed in 7.5.3 · Affected: scriban before 7.5.3 · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 36% of scored CVEs
DescriptionCVE.org
Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust memory and CPU because builtins like math.format, regex.replace and string.escape skip the LimitToString allocation guard. Attackers can submit small templates using huge format precision specifiers, shared-structure array comparison, BigInteger multiplication or exponential function recursion that ignore LoopLimit and CancellationToken, crashing or stalling multi-tenant hosts.
Affected products2
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- scriban · scribanbefore 7.5.3
- scriban · scribanbefore 7.5.3
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- scriban
- Published
- November 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-124437 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.