Threats Tagged 'ghsa-p6q4-fgr8-vx4p'
View all threats tagged with 'ghsa-p6q4-fgr8-vx4p'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-p6q4-fgr8-vx4p'
Click on any threat for detailed analysis and mitigation recommendations
Scriban has a Stack Overflow via Nested Array Initializers That Bypass the ExpressionDepthLimit Fix 0 ### Summary StackOverflowException via nested array initializers bypasses ExpressionDepthLimit fix (GHSA-wgh7-7m3c-fx25) ### Details The recent fix for GHSA-wgh7-7m3c-fx25 (uncontrolled recursion in parser) added `ExpressionDepthLimit` defaulting to 250. However, deeply nested **array initializers** (`[[[[...`) recurse through `ParseArrayInitializer` → `ParseExpression` → `ParseArrayInitializer`, which is a **different recursion path** not covered by the expression depth counter. This causes a `StackOverflowException` on current main (commit b5ac4bf - "Add limits for default safety"). ### PoC ``` using Scriban; // ExpressionDepthLimit (default 250) does NOT prevent this crash string nested = "{{ " + new string('[', 5000) + "1" + new string(']', 5000) + " }}"; Template.Parse(nested); // StackOverflowException - process terminates ``` ### Impact Same as GHSA-wgh7-7m3c-fx25: High severity. StackOverflowException cannot be caught with try/catch in .NET - the process terminates immediately. Any application calling Template.Parse with untrusted input is vulnerable, even with the new default ExpressionDepthLimit enabled. Join the discussion | GCVE Database | 03/24/2026, 22:06:24 UTC Added: 07/06/2026, 23:04:01 UTC |
Showing 1 to 1 of 1 result