{"id":"GO-2026-6574","revision":"5d0ead9ce2cd4c868b6cc1bdee7b3078","records":[{"revision":"5d0ead9ce2cd4c868b6cc1bdee7b3078","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6574","aliases":["CVE-2026-76804","GHSA-qgw5-7j4f-fg97"],"title":"Nuclei: Local File Read via Workflow File-Protocol Gate Bypass in github.com/projectdiscovery/nuclei","description":"Nuclei: Local File Read via Workflow File-Protocol Gate Bypass in github.com/projectdiscovery/nuclei","state":0,"publishedAt":"2026-10-01T20:23:38+00:00","modifiedAt":"2026-10-01T20:45:15.8889173+00:00","affected":[{"ecosystem":"Go","name":"github.com/projectdiscovery/nuclei","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/projectdiscovery/nuclei/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/projectdiscovery/nuclei/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.10.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-qgw5-7j4f-fg97","https://nvd.nist.gov/vuln/detail/CVE-2026-76804","https://github.com/projectdiscovery/nuclei/commit/638be4481d27f1bbf90f971bbf6e3023777f2089","https://github.com/projectdiscovery/nuclei/pull/7489","https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6574","license":"OSV · upstream source license applies","key":"osv:GO-2026-6574","identifiers":["GO-2026-6574","CVE-2026-76804","GHSA-qgw5-7j4f-fg97"]},"retained":false,"historicalAffected":[]}],"coverage":[]}