CVE-2026-41646

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require() function, bypassing the default local file access restriction. This issue has been patched in version 3.8.0.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/projectdiscovery/nuclei/commit/6f2ade6a9b427c284c15a43445f9c7f055e60e5d	Patch
https://github.com/projectdiscovery/nuclei/pull/7332	Issue Tracking Patch
https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-29rg-wmcw-hpf4	Mitigation Patch Vendor Advisory
https://github.com/projectdiscovery/nuclei/pull/7332	Issue Tracking Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:projectdiscovery:nuclei:*:*:*:*:*:go:*:*

History

26 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Nuclei es un escáner de vulnerabilidades construido sobre un DSL simple basado en YAML. Desde la versión 3.0.0 hasta antes de la versión 3.8.0, una vulnerabilidad en el tiempo de ejecución del protocolo JavaScript de Nuclei permite que las plantillas de JavaScript lean archivos .js y .json locales a través de la función require(), eludiendo la restricción predeterminada de acceso a archivos locales. Este problema ha sido parcheado en la versión 3.8.0.

Information

Published : 2026-05-08 04:16

Updated : 2026-10-26 00:10

NVD link : CVE-2026-41646

Mitre link : CVE-2026-41646

CVE.ORG link : CVE-2026-41646

JSON object : View

Products Affected

projectdiscovery

nuclei

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-41646", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41646", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-08T14:11:12.263139Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "projectdiscovery", "product": "nuclei", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.8.0"}]}]}], "published": "2026-05-08T04:16:18.383", "references": [{"url": "https://github.com/projectdiscovery/nuclei/commit/6f2ade6a9b427c284c15a43445f9c7f055e60e5d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/projectdiscovery/nuclei/pull/7332", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-29rg-wmcw-hpf4", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/projectdiscovery/nuclei/pull/7332", "tags": ["Issue Tracking", "Patch"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require() function, bypassing the default local file access restriction. This issue has been patched in version 3.8.0."}, {"lang": "es", "value": "Nuclei es un esc\u00e1ner de vulnerabilidades construido sobre un DSL simple basado en YAML. Desde la versi\u00f3n 3.0.0 hasta antes de la versi\u00f3n 3.8.0, una vulnerabilidad en el tiempo de ejecuci\u00f3n del protocolo JavaScript de Nuclei permite que las plantillas de JavaScript lean archivos .js y .json locales a trav\u00e9s de la funci\u00f3n require(), eludiendo la restricci\u00f3n predeterminada de acceso a archivos locales. Este problema ha sido parcheado en la versi\u00f3n 3.8.0."}], "lastModified": "2026-10-26T00:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:projectdiscovery:nuclei:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "9E442141-1965-481A-BE82-B6DC11B58EAC", "versionEndExcluding": "3.8.0", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}