Nuclei: Local File Read via require() Module Loader Bypass

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-41646 · Microsoft / collected KEV context

EUVD-2026-28499

GHSA-29rg-wmcw-hpf4

GO-2026-4965

cve-program · CVE-2026-41646

• https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-29rg-wmcw-hpf4
• https://github.com/projectdiscovery/nuclei/pull/7332
• https://github.com/projectdiscovery/nuclei/commit/6f2ade6a9b427c284c15a43445f9c7f055e60e5d

euvd · EUVD-2026-28499

• https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-29rg-wmcw-hpf4
• https://github.com/projectdiscovery/nuclei/pull/7332
• https://github.com/projectdiscovery/nuclei/commit/6f2ade6a9b427c284c15a43445f9c7f055e60e5d

nvd · CVE-2026-41646

• https://github.com/projectdiscovery/nuclei/commit/6f2ade6a9b427c284c15a43445f9c7f055e60e5d
• https://github.com/projectdiscovery/nuclei/pull/7332
• https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-29rg-wmcw-hpf4

osv · GHSA-29rg-wmcw-hpf4

• https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-29rg-wmcw-hpf4
• https://nvd.nist.gov/vuln/detail/CVE-2026-41646
• https://github.com/projectdiscovery/nuclei/pull/7332
• https://github.com/projectdiscovery/nuclei/commit/6f2ade6a9b427c284c15a43445f9c7f055e60e5d
• https://github.com/projectdiscovery/nuclei

osv · GO-2026-4965

• https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-29rg-wmcw-hpf4
• https://nvd.nist.gov/vuln/detail/CVE-2026-41646
• https://github.com/projectdiscovery/nuclei/commit/6f2ade6a9b427c284c15a43445f9c7f055e60e5d
• https://github.com/projectdiscovery/nuclei/pull/7332

No related operational record is retained in the current change model.