CVE-2026-74788 in Scriban's PadLeft/PadRight functions isn't just a missing width validation — it's a case where an existing security control created a false sense of protection that masked the actual vulnerability. LimitToString enforces a cap on output string length after allocation is complete. The pad functions exploit the input parameter before allocation happens. These are separate security boundaries that Scriban's API presented as interchangeable, and that's the architectural failure that allowed this to persist.
The gap exists because width parameters don't go through the same validation path as the resulting string. PadLeft and PadRight allocate memory proportional to the input width — a single parameter an attacker controls directly. The allocation happens before LimitToString ever sees the result. If you're defending a Scriban deployment, check your template rendering pipelines for any user-controlled width parameters passed to these functions, regardless of whether you've enabled LimitToString.
The deeper concern is that this is a known attack class across template ecosystems. PHP's str_repeat, Python's string multiplication, and Ruby's String#* all have CVEs in this family. The pattern keeps appearing because output-size checking and input-parameter validation are treated as fungible — a mental model the API reinforced. The 7.0.0 fix adds width validation, which is correct for this instance, but the design question remains: other functions in Scriban may share the same input-output validation gap. Treat input bounds and output limits as independent controls going forward, not as interchangeable safeguards.