Unsigned code template execution through workflows in projectdiscovery/nuclei
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.
Summary
projectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL. A significant security oversight was identified in Nuclei v3, involving the execution of unsigned code templates through workflows. This vulnerability specifically affects users utilizing custom workflows, potentially allowing the execution of malicious code on the user's system. This advisory outlines the impacted users, provides details on the security patch, and suggests mitigation strategies. The vulnerability is addressed in Nuclei v3.2.0. Users are strongly recommended to update to this version to mitigate the security risk. Users should refrain from using custom workflows if unable to upgrade immediately. Only trusted, verified workflows should be executed.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| projectdiscovery | nuclei | 3.0.0 to before 3.2.0 | 3.2.0 | Patch available | CNA |
| — | github.com/projectdiscovery/nuclei/v3 (Go) | 3.0.0 to before 3.2.0 | 3.2.0 | Patch available | GHSA-w5wx-6g2r-r78q |
- nuclei Vendorprojectdiscovery Affected 3.0.0 to before 3.2.0 Fixed in 3.2.0 Patch available CNA
- github.com/projectdiscovery/nuclei/v3 (Go) Vendor— Affected 3.0.0 to before 3.2.0 Fixed in 3.2.0 Patch available GHSA-w5wx-6g2r-r78q
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:projectdiscovery:nuclei:*:*:*:*:*:*:*:* | 3.0.0 to before 3.2.0 | Vulnerable | projectdiscovery |
- cpe:2.3:a:projectdiscovery:nuclei:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.2.0 Vulnerable ·projectdiscovery
Remediation
- Fix · CNA nuclei (projectdiscovery) Fixed in 3.2.0
- Fix · GHSA-w5wx-6g2r-r78q github.com/projectdiscovery/nuclei/v3 (Go) Fixed in 3.2.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-27920
- 2026-10-03 Alias added: GHSA-w5wx-6g2r-r78q
References
Advisory 2
Other 6
- https://github.com/projectdiscovery/nuclei/pull/4822
- https://docs.projectdiscovery.io/templates/protocols/code
- https://docs.projectdiscovery.io/templates/reference/template-signing
- https://docs.projectdiscovery.io/templates/workflows/overview
- https://github.com/projectdiscovery/nuclei/commit/e86f38299765b82ad724fdb701557e0eaff3884d
- https://github.com/projectdiscovery/nuclei
More projectdiscovery Nuclei vulnerabilities
- TI-2024-29054 Nuclei Template Signature Verification Bypass CVSS 3.1HIGH 7.8
- TI-2026-29888 Code injection in projectdiscovery Nuclei CVSS 3.1HIGH 7.5
- TI-2026-30165 Nuclei: Local File Read via require() Module Loader Bypass CVSS 3.1MEDIUM 5.5
- TI-2023-19329 Nuclei Path Traversal vulnerability CVSS 3.1HIGH 7.5
- TI-2026-30164 Nuclei: Environment variable disclosure via Response-Derived DSL Expressions CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-27920 · CVE Program
- CVE-2024-27920 · NVD
- FIRST EPSS
- GHSA-w5wx-6g2r-r78q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences