The vulnerability in Scriban affects versions before 7.0.0 and arises because the LoopLimit enforcement only applies to explicit script loop statements, not to internal iterations performed by built-in functions or operators. The ScriptRange iteration and operations such as array size calculation or string multiplication perform large iterations or allocations without invoking the LoopLimit checks, allowing attackers to cause excessive CPU or memory usage. This bypass leads to uncontrolled resource consumption, potentially causing denial of service in systems that rely on LoopLimit for safe runtime execution of untrusted templates.

Applications that accept attacker-controlled templates and rely on Scriban's LoopLimit to restrict resource usage can be forced into heavy CPU or memory consumption by a single crafted expression. This can degrade performance or cause denial of service. Affected systems include template-as-a-service platforms, content management systems, email rendering systems, and any multi-tenant environments using Scriban with untrusted content. The vulnerability does not impact confidentiality or integrity but has a high impact on availability due to resource exhaustion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted templates or implement additional external resource usage controls. Do not rely solely on LoopLimit to prevent resource exhaustion in Scriban templates. Monitor for updates from the Scriban maintainers regarding an official fix.