Advisory Database
  • Advisories
  • Dependency Scanning
  1. nuget
  2. ›
  3. Scriban.Signed
  4. ›
  5. GHSA-xcx6-vp38-8hr5

GHSA-xcx6-vp38-8hr5: Scriban has Uncontrolled Recursion in `object.to_json` Causing Unrecoverable Process Crash via StackOverflowException

March 24, 2026 (updated July 6, 2026)

The object.to_json builtin function in Scriban performs recursive JSON serialization via an internal WriteValue() static local function that has no depth limit, no circular reference detection, and no stack overflow guard. A Scriban template containing a self-referencing object passed to object.to_json triggers unbounded recursion, causing a StackOverflowException that terminates the hosting .NET process. This is a fatal, unrecoverable crash — StackOverflowException cannot be caught by user code in .NET.

References

  • github.com/advisories/GHSA-xcx6-vp38-8hr5
  • github.com/scriban/scriban/security/advisories/GHSA-xcx6-vp38-8hr5

Code Behaviors & Features

Detect and mitigate GHSA-xcx6-vp38-8hr5 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions before 7.0.0

Fixed versions

  • 7.0.0

Solution

Upgrade to version 7.0.0 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-674: Uncontrolled Recursion

Source file

nuget/Scriban.Signed/GHSA-xcx6-vp38-8hr5.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:16:20 +0000.