high8.7
CVE-2026-74784
Scriban before 7.2.0 contains a denial of service vulnerability in the array.insert_at function that allocates unbounded null entries without respecting LoopLi…
Impact
Scriban before 7.2.0 contains a denial of service vulnerability in the array.insert_at function that allocates unbounded null entries without respecting LoopLimit or LimitToString constraints. Attackers can supply a large index parameter to trigger OutOfMemoryException and crash the host process in under a second.
Affected products
| Product | Affected versions |
|---|---|
| Scriban | before 7.2.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.