What is CVE-2026-74786?
A denial-of-service vulnerability exists in Scriban template engine where the LimitToString safety limit (default 1MB) can be bypassed via ObjectToString. This occurs because the _currentToStringLength counter is reset on every top-level call, allowing StringBuilderOutput enforcement to be circumvented. Affected versions are before 7.0.0, and an upgrade is recommended.
Azərbaycanca: Scriban şablon mühərrikindəki CVE-2026-74786 zəifliyi `LimitToString` təhlükəsizlik limitinin (default 1MB) `ObjectToString` metodu vasitəsilə bypass edilməsinə imkan verir. Bu, `_currentToStringLength` sayğacının hər yuxarı səviyyəli çağırışda sıfırlanması ucbatından denial-of-service (DoS) hücumlarına şərait yaradır. 7.0.0 versiyasından əvvəlki versiyalar təsirlənir, yeniləmə tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-400
FAQ1
What action is recommended to protect against CVE-2026-74786?
It is recommended to upgrade the Scriban template engine to version 7.0.0 or higher, as versions before 7.0.0 are affected by this vulnerability.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.