Threats tagged 'ghsa-42c9-wc59-xmx4'

Scriban and Scriban.Signed versions before 7.5.3 have uncontrolled recursion vulnerabilities. These flaws involve postfix member, indexer, and call chains that bypass the ExpressionDepthLimit, array comparisons lacking depth and cycle checks, and object.eval bypassing the RecursiveLimit. An attacker able to supply templates can cause an uncatchable StackOverflowException, leading to termination of the host process.