Nuclei: Environment variable disclosure via Response-Derived DSL Expressions
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's expression evaluation engine makes it possible for a malicious target server to inject and execute supported DSL expressions. This happens when HTTP response data containing helper/function syntax gets reused by multi-step templates. If the -env-vars / -ev option is explicitly enabled, this can expose host environment variables. That option is off by default, so standard configurations are not affected by the information disclosure risk. This issue has been patched in version 3.8.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| projectdiscovery | nuclei | 3.0.0 to before 3.8.0 | 3.8.0 | Patch available | CNA |
| — | github.com/projectdiscovery/nuclei/v3 (Go) | 3.0.0 to before 3.8.0 | 3.8.0 | Patch available | GHSA-jm34-66cf-qpvr |
- nuclei Vendorprojectdiscovery Affected 3.0.0 to before 3.8.0 Fixed in 3.8.0 Patch available CNA
- github.com/projectdiscovery/nuclei/v3 (Go) Vendor— Affected 3.0.0 to before 3.8.0 Fixed in 3.8.0 Patch available GHSA-jm34-66cf-qpvr
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:projectdiscovery:nuclei:*:*:*:*:*:go:*:* | 3.0.0 to before 3.8.0 | Vulnerable | projectdiscovery |
- cpe:2.3:a:projectdiscovery:nuclei:*:*:*:*:*:go:*:* Versions 3.0.0 to before 3.8.0 Vulnerable ·projectdiscovery
Remediation
- Fix · CNA nuclei (projectdiscovery) Fixed in 3.8.0
- Fix · GHSA-jm34-66cf-qpvr github.com/projectdiscovery/nuclei/v3 (Go) Fixed in 3.8.0 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-41645
- 2026-10-03 Alias added: GHSA-jm34-66cf-qpvr
References
Patch 5
- https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jm34-66cf-qpvr
- https://github.com/projectdiscovery/nuclei/pull/7221
- https://github.com/projectdiscovery/nuclei/pull/7321
- https://github.com/projectdiscovery/nuclei/commit/6c803c74d193f85f8a6d9803ce493fd302cad0eb
- https://github.com/projectdiscovery/nuclei/commit/d2217320162d5782ca7cb95bef9dda17063818f3
More projectdiscovery Nuclei vulnerabilities
- TI-2024-29054 Nuclei Template Signature Verification Bypass CVSS 3.1HIGH 7.8
- TI-2026-29888 Code injection in projectdiscovery Nuclei CVSS 3.1HIGH 7.5
- TI-2026-30165 Nuclei: Local File Read via require() Module Loader Bypass CVSS 3.1MEDIUM 5.5
- TI-2023-19329 Nuclei Path Traversal vulnerability CVSS 3.1HIGH 7.5
- TI-2024-18525 Unsigned code template execution through workflows in projectdiscovery/nuclei CVSS 3.1HIGH 7.4
Sources
- CVE-2026-41645 · CVE Program
- CVE-2026-41645 · NVD
- FIRST EPSS
- GHSA-jm34-66cf-qpvr · GitHub Advisory Database · CC BY 4.0
- CVE-2026-41645 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences