What is GHSA-jg4x-p32p-q6xr?

GHSA-jg4x-p32p-q6xr is a security advisory published by GitHub Security Advisories with High severity. Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that...

Which CVE IDs does GHSA-jg4x-p32p-q6xr cover?

GHSA-jg4x-p32p-q6xr covers the following CVE IDs: CVE-2026-74783. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jg4x-p32p-q6xr?

GHSA-jg4x-p32p-q6xr has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-jg4x-p32p-q6xrHighCVSS 7.5

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that...

Vendor

GitHub Security Advisories

Published

August 16, 2026

Last Modified

August 16, 2026

🔗 CVE IDs covered (1)

CVE-2026-74783 →

📋 Description

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger an uncatchable StackOverflowException that immediately terminates the host process.

🔗 References (4)

https://github.com/scriban/scriban/security/advisories/GHSA-6q7j-xr26-3h2c
https://nvd.nist.gov/vuln/detail/CVE-2026-74783
https://www.vulncheck.com/advisories/scriban-through-parser-recursion-denial-of-service
https://github.com/advisories/GHSA-jg4x-p32p-q6xr