CVE-2026-76802
MediumCVSS 4.7Summary
In Nuclei from 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template signature check before accepting a template that contains both a fuzzing: block and an unsigned code: block. When an operator enables -dast, an untrusted multiprotocol template can place an unsigned code request into the execution queue and run arbitrary shell commands even without -code or a valid cryptographic signature.
Risk Assessment
Untrusted templates can lead to remote execution of arbitrary shell commands on the scanner host, potentially resulting in full system compromise. This affects CLI DAST scans and SDK integrations with DAST enabled.
Recommendation
Upgrade Nuclei to version 3.10.0 or later. Until then, do not run DAST scans on untrusted templates and restrict SDK integrations that accept external templates.
Other vulnerabilities in Nuclei
See all- CVE-2026-76805Medium
In Nuclei from 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal extractor to be reinterpreted as template syntax. When -env-vars is enabled, a malicious scan target can return marker-shaped content that discloses scanner-host environment variables such as credentials, API keys, or tokens.
- CVE-2026-76804Medium
In Nuclei from 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a file-protocol template and read local files from the scanner host even when the operator has not enabled file templates.
- CVE-2026-76803Medium
In Nuclei from 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an attacker-controlled MySQL-compatible endpoint can cause the server to issue LOAD DATA LOCAL INFILE requests for arbitrary paths, after which the scanner's MySQL client reads the files and returns their contents to the server even though -allow-local-file-access is disabled.
- CVE-2026-92718High
Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.
Original NVD description (English source)
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template signature check before accepting a template that contains both a fuzzing: block and an unsigned code: block. When an operator enables -dast, an untrusted multiprotocol template can place an unsigned code request into the execution queue and run arbitrary shell commands even without -code or a valid cryptographic signature. The issue affects CLI DAST scans and SDK integrations that enable DAST while accepting attacker-supplied templates. This issue is fixed in version 3.10.0.