{"id":"CVE-2026-41645","sourceIdentifier":"security-advisories@github.com","published":"2026-05-08T04:16:18.177","lastModified":"2026-10-26T20:10:00.160","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's expression evaluation engine makes it possible for a malicious target server to inject and execute supported DSL expressions. This happens when HTTP response data containing helper/function syntax gets reused by multi-step templates. If the -env-vars / -ev option is explicitly enabled, this can expose host environment variables. That option is off by default, so standard configurations are not affected by the information disclosure risk. This issue has been patched in version 3.8.0."},{"lang":"es","value":"Nuclei es un escáner de vulnerabilidades construido sobre un DSL simple basado en YAML. Desde la versión 3.0.0 hasta antes de la versión 3.8.0, una vulnerabilidad en el motor de evaluación de expresiones de Nuclei permite que un servidor objetivo malicioso inyecte y ejecute expresiones DSL compatibles. Esto ocurre cuando los datos de respuesta HTTP que contienen sintaxis de ayudante/función son reutilizados por plantillas de varios pasos. Si la opción -env-vars / -ev está explícitamente habilitada, esto puede exponer variables de entorno del host. Esa opción está desactivada por defecto, por lo que las configuraciones estándar no se ven afectadas por el riesgo de revelación de información. Este problema ha sido parcheado en la versión 3.8.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"projectdiscovery","product":"nuclei","versions":[{"version":">= 3.0.0, < 3.8.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-11T18:15:43.322968Z","id":"CVE-2026-41645","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:projectdiscovery:nuclei:*:*:*:*:*:go:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.8.0","matchCriteriaId":"9E442141-1965-481A-BE82-B6DC11B58EAC"}]}]}],"references":[{"url":"https://github.com/projectdiscovery/nuclei/commit/6c803c74d193f85f8a6d9803ce493fd302cad0eb","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/projectdiscovery/nuclei/commit/d2217320162d5782ca7cb95bef9dda17063818f3","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/projectdiscovery/nuclei/pull/7221","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/projectdiscovery/nuclei/pull/7321","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/projectdiscovery/nuclei/releases/tag/v3.8.0","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jm34-66cf-qpvr","source":"security-advisories@github.com","tags":["Mitigation","Patch","Vendor Advisory"]}]}