CVE-2026-41646

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require() function, bypassing the default local file access restriction. This issue has been patched in version 3.8.0.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/projectdiscovery/nuclei/commit/6f2ade6a9b427c284c15a43445f9c7f055e60e5d	Patch
https://github.com/projectdiscovery/nuclei/pull/7332	Issue Tracking Patch
https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-29rg-wmcw-hpf4	Mitigation Patch Vendor Advisory
https://github.com/projectdiscovery/nuclei/pull/7332	Issue Tracking Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:projectdiscovery:nuclei:*:*:*:*:*:go:*:*

History

No history.

Information

Published : 2026-05-08 04:16

Updated : 2026-06-17 10:46

NVD link : CVE-2026-41646

Mitre link : CVE-2026-41646

CVE.ORG link : CVE-2026-41646

JSON object : View

Products Affected

projectdiscovery

nuclei

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-41646", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41646", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-08T14:11:12.263139Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "projectdiscovery", "product": "nuclei", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.8.0"}]}]}], "published": "2026-05-08T04:16:18.383", "references": [{"url": "https://github.com/projectdiscovery/nuclei/commit/6f2ade6a9b427c284c15a43445f9c7f055e60e5d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/projectdiscovery/nuclei/pull/7332", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-29rg-wmcw-hpf4", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/projectdiscovery/nuclei/pull/7332", "tags": ["Issue Tracking", "Patch"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require() function, bypassing the default local file access restriction. This issue has been patched in version 3.8.0."}], "lastModified": "2026-06-17T10:46:56.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:projectdiscovery:nuclei:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "9E442141-1965-481A-BE82-B6DC11B58EAC", "versionEndExcluding": "3.8.0", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}