The Scriban template engine's array multiplication operator (array * int) in ScriptArray<T>.TryEvaluate does not enforce the LoopLimit or LimitToString resource constraints and uses unchecked integer arithmetic for allocation size. This allows an attacker to specify a large integer multiplier that causes the allocation of a very large array, leading to denial-of-service via excessive memory consumption. The vulnerability has existed since the operator's introduction in version 3.0.0 and persists through versions 6.6.0, 7.0.0, and 7.2.0. Unlike sibling operations such as string * int and array.insert_at, which have LoopLimit protections, array * int lacks these guards. When allocation fails, the exception is wrapped and surfaced as a ScriptRuntimeException. No official patch or fix is currently documented for this issue.

An attacker can cause a denial-of-service condition by triggering large memory allocations through the array * integer operator in Scriban templates. This can exhaust system memory, potentially crashing the host application or severely degrading performance. The vulnerability does not require privileges or user interaction and can be triggered remotely if untrusted templates are rendered. No code execution or data leakage is indicated. The impact is limited to resource exhaustion (DoS).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid rendering untrusted templates that use the array multiplication operator with large integer values. Implement external resource usage monitoring and limit template input size where possible. Do not rely on Scriban's internal LoopLimit protections for this operator as they are currently incomplete.