CVE-2026-76802

In Nuclei from 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal extractor to be reinterpreted as template syntax. When -env-vars is enabled, a malicious scan target can return marker-shaped content that discloses scanner-host environment variables such as credentials, API keys, or tokens.

In Nuclei from 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a file-protocol template and read local files from the scanner host even when the operator has not enabled file templates.

In Nuclei from 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an attacker-controlled MySQL-compatible endpoint can cause the server to issue LOAD DATA LOCAL INFILE requests for arbitrary paths, after which the scanner's MySQL client reads the files and returns their contents to the server even though -allow-local-file-access is disabled.

Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.

In Nuclei versions 3.0.0 to before 3.8.0, a vulnerability in the JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require() function, bypassing the default local file access restriction.

Nuclei is a vulnerability scanner built on a YAML-based DSL. From version 3.0.0 to before 3.8.0, a vulnerability in the expression evaluation engine allows a malicious target server to inject and execute supported DSL expressions. This occurs when HTTP response data containing helper/function syntax is reused by multi-step templates. If the -env-vars / -ev option is explicitly enabled, host environment variables may be exposed; the option is off by default.