Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-41645: Nuclei scanner may leak server environment variables
CVE-2026-41645 · published 6 months ago
Summary
Versions of Nuclei from 3.0.0 up to 3.7.x could let a malicious web site insert special commands that are run when the scanner processes multi‑step templates. If you have turned on the optional feature that shows environment variables, those variables could be exposed to the remote site. Upgrade Nuclei to version 3.8.0 or later, or keep the environment‑variable feature disabled.
What to do
- Update github.com projectdiscovery to version 3.8.0.
- Update projectdiscovery nuclei to version 3.8.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | projectdiscovery |
>= 3.0.0, < 3.8.0 Fix: upgrade to 3.8.0
|
| – | projectdiscovery | nuclei |
>= 3.0.0, < 3.8.0 cpe:2.3:a:projectdiscovery:nuclei:*:*:*:*:*:go:*:* |
Original advisory text
Nuclei: Environment variable disclosure via Response-Derived DSL Expressions
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's expression evaluation engine makes it possible for a malicious target server to inject and execute supported DSL expressions. This happens when HTTP response data containing helper/function syntax gets reused by multi-step templates. If the -env-vars / -ev option is explicitly enabled, this can expose host environment variables. That option is off by default, so standard configurations are not affected by the information disclosure risk. This issue has been patched in version 3.8.0.
References
- https://github.com/projectdiscovery/nuclei/pull/7221 Issue Tracking Patch
- https://github.com/projectdiscovery/nuclei/pull/7321 Issue Tracking Patch
- https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jm34-66cf-qp... Mitigation Patch Vendor Advisory
- https://github.com/advisories/GHSA-jm34-66cf-qpvr
- https://github.com/projectdiscovery/nuclei/commit/6c803c74d193f85f8a6d9803ce493f... Patch
- https://github.com/projectdiscovery/nuclei/commit/d2217320162d5782ca7cb95bef9dda... Patch
- https://github.com/projectdiscovery/nuclei/releases/tag/v3.8.0 Product Release Notes
- https://nvd.nist.gov/vuln/detail/CVE-2026-41645
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-94Code Injection
Timeline
Published8 May 2026
Updated4 Nov 2026
First seen22 Apr 2026
Track software like this
Free during beta