CVE-2026-3384: ChaiScript Uncontrolled Recursion Vulnerability

CVE-2026-3384 Overview

A security vulnerability has been identified in ChaiScript, an embedded scripting language for C++, affecting versions up to and including 6.1.0. This vulnerability exists in the chaiscript::eval::AST_Node_Impl::eval and chaiscript::eval::Function_Push_Pop functions within the file include/chaiscript/language/chaiscript_eval.hpp. The flaw allows for uncontrolled recursion, which can be exploited to cause a denial of service condition through resource exhaustion.

Critical Impact
Local attackers with low privileges can trigger uncontrolled recursion leading to stack exhaustion and application crash, causing denial of service for applications embedding ChaiScript.

Affected Products

ChaiScript versions up to and including 6.1.0
Applications embedding ChaiScript scripting engine
C++ projects utilizing ChaiScript for embedded scripting functionality

Discovery Timeline

2026-03-01 - CVE-2026-3384 published to NVD
2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-3384

Vulnerability Analysis

This vulnerability is classified as an uncontrolled recursion issue (CWE-404: Improper Resource Shutdown or Release). The vulnerability resides in the AST (Abstract Syntax Tree) evaluation logic within ChaiScript's core evaluation engine. When processing certain maliciously crafted scripts, the evaluation functions fail to properly limit recursion depth, allowing an attacker to construct input that triggers deeply nested function calls.

The affected code path involves the AST_Node_Impl::eval method and the Function_Push_Pop helper class in chaiscript_eval.hpp. These components are responsible for traversing and evaluating the parsed script's AST representation. Without proper recursion bounds checking, deeply nested or circular script constructs can cause the call stack to grow unboundedly until stack memory is exhausted.

The attack requires local access to the system running an application that embeds ChaiScript, and the attacker must be able to provide malicious script input to the ChaiScript interpreter. While this limits the attack surface compared to remote vulnerabilities, applications that accept user-provided scripts for evaluation are at risk.

Root Cause

The root cause of this vulnerability is the absence of adequate recursion depth limits in the AST evaluation logic. The chaiscript::eval::AST_Node_Impl::eval function recursively processes AST nodes without implementing a maximum depth counter or guard mechanism. This allows malicious or malformed scripts containing deeply nested expressions, recursive function definitions, or circular reference patterns to exhaust stack resources.

Attack Vector

The attack vector is local, requiring an attacker to have access to provide script input to an application using ChaiScript. The attacker constructs a script designed to trigger excessive recursion in the evaluation engine. This could involve:

Deeply nested function calls or expressions
Self-referential or mutually recursive constructs
Pathological AST structures that maximize recursion depth

When the vulnerable ChaiScript interpreter attempts to evaluate such a script, the uncontrolled recursion leads to stack exhaustion, causing the host application to crash or become unresponsive. The exploit has been publicly disclosed through GitHub Issue #633, increasing the risk of exploitation.

The vulnerability mechanism involves the recursive traversal of AST nodes during script evaluation. When maliciously crafted input creates an extremely deep or circular AST structure, each level of recursion consumes stack space. Without depth limiting, this eventually exceeds available stack memory, triggering a stack overflow condition. Technical details regarding the specific exploitation mechanism can be found in the public issue report.

Detection Methods for CVE-2026-3384

Indicators of Compromise

Unexpected application crashes with stack overflow errors in processes using ChaiScript
Abnormally large or deeply nested script files being processed by ChaiScript-enabled applications
Core dumps or crash logs indicating stack exhaustion in chaiscript_eval.hpp related functions

Detection Strategies

Monitor for application crashes with stack traces containing chaiscript::eval::AST_Node_Impl::eval or chaiscript::eval::Function_Push_Pop
Implement runtime monitoring for abnormal stack usage in applications embedding ChaiScript
Analyze script inputs for suspicious nesting depth or recursive patterns before evaluation

Monitoring Recommendations

Enable crash reporting and analysis for applications using ChaiScript to identify potential exploitation attempts
Log and audit all script inputs provided to ChaiScript interpreters, particularly from untrusted sources
Set up resource usage alerts for abnormal memory or stack consumption patterns

How to Mitigate CVE-2026-3384

Immediate Actions Required

Evaluate whether your applications use ChaiScript version 6.1.0 or earlier and assess exposure to untrusted script input
Restrict script execution capabilities to trusted users or sources where possible
Implement application-level recursion or resource limits before passing scripts to ChaiScript
Consider sandboxing ChaiScript execution to contain potential denial of service impacts

Patch Information

At the time of publication, the ChaiScript project has been notified of this vulnerability through GitHub Issue #633 but has not yet released an official patch. Organizations using ChaiScript should monitor the ChaiScript GitHub repository for security updates. Additional vulnerability details are available through VulDB #348270.

Workarounds

Implement input validation to reject scripts exceeding a reasonable complexity or nesting threshold before ChaiScript evaluation
Apply operating system-level stack size limits to contain the impact of uncontrolled recursion
Isolate ChaiScript execution in separate processes with resource limits to prevent crashes from affecting the main application
Disable or restrict ChaiScript functionality in production environments where untrusted input may be processed

bash

# Example: Limit stack size for ChaiScript-enabled applications (Linux)
ulimit -s 8192  # Set stack size limit to 8MB
./chaiscript_application