GHSA-c875-h985-hvrc: Scriban: Built-in operations bypass LoopLimit and delay cancellation, enabling Denial of Service

Scriban’s LoopLimit only applies to script loop statements, not to expensive iteration performed inside operators and builtins. An attacker can submit a single expression such as {{ 1..1000000 | array.size }} and force large amounts of CPU work even when LoopLimit is set to a very small value.