{"id":"GO-2026-4965","revision":"683478eefd6e47a08a89549df476d584","records":[{"revision":"683478eefd6e47a08a89549df476d584","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-4965","aliases":["CVE-2026-41646","GHSA-29rg-wmcw-hpf4"],"title":"Nuclei: Local File Read via require() Module Loader Bypass in github.com/projectdiscovery/nuclei","description":"Nuclei: Local File Read via require() Module Loader Bypass in github.com/projectdiscovery/nuclei","state":0,"publishedAt":"2026-05-20T19:07:16+00:00","modifiedAt":"2026-05-20T19:30:11.5909829+00:00","affected":[{"ecosystem":"Go","name":"github.com/projectdiscovery/nuclei","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/projectdiscovery/nuclei/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/projectdiscovery/nuclei/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.8.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-29rg-wmcw-hpf4","https://nvd.nist.gov/vuln/detail/CVE-2026-41646","https://github.com/projectdiscovery/nuclei/commit/6f2ade6a9b427c284c15a43445f9c7f055e60e5d","https://github.com/projectdiscovery/nuclei/pull/7332"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-4965","license":"OSV · upstream source license applies","key":"osv:GO-2026-4965","identifiers":["GO-2026-4965","CVE-2026-41646","GHSA-29rg-wmcw-hpf4"]},"retained":false,"historicalAffected":[]}],"coverage":[]}