Nuclei: Local File Read via require() Module Loader Bypass
Priority MEDIUM 58CWE-284Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.
Summary
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require() function, bypassing the default local file access restriction. This issue has been patched in version 3.8.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00114 1st percentileScored 2026-11-07
Fix Fixed nuclei (projectdiscovery): 3.8.0github.com/projectdiscovery/nuclei/v3 (Go): 3.8.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| projectdiscovery | nuclei | 3.0.0 to before 3.8.0 | 3.8.0 | Patch available | CNA |
| — | github.com/projectdiscovery/nuclei/v3 (Go) | 3.0.0 to before 3.8.0 | 3.8.0 | Patch available | GHSA-29rg-wmcw-hpf4 |
- nuclei Vendorprojectdiscovery Affected 3.0.0 to before 3.8.0 Fixed in 3.8.0 Patch available CNA
- github.com/projectdiscovery/nuclei/v3 (Go) Vendor— Affected 3.0.0 to before 3.8.0 Fixed in 3.8.0 Patch available GHSA-29rg-wmcw-hpf4
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:projectdiscovery:nuclei:*:*:*:*:*:go:*:* | 3.0.0 to before 3.8.0 | Vulnerable | projectdiscovery |
- cpe:2.3:a:projectdiscovery:nuclei:*:*:*:*:*:go:*:* Versions 3.0.0 to before 3.8.0 Vulnerable ·projectdiscovery
Remediation
- Fix · CNA nuclei (projectdiscovery) Fixed in 3.8.0
- Fix · GHSA-29rg-wmcw-hpf4 github.com/projectdiscovery/nuclei/v3 (Go) Fixed in 3.8.0 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-41646
- 2026-10-03 Alias added: GHSA-29rg-wmcw-hpf4
References
Patch 3
More projectdiscovery Nuclei vulnerabilities
- TI-2024-29054 Nuclei Template Signature Verification Bypass CVSS 3.1HIGH 7.8
- TI-2026-29888 Code injection in projectdiscovery Nuclei CVSS 3.1HIGH 7.5
- TI-2023-19329 Nuclei Path Traversal vulnerability CVSS 3.1HIGH 7.5
- TI-2024-18525 Unsigned code template execution through workflows in projectdiscovery/nuclei CVSS 3.1HIGH 7.4
- TI-2026-30164 Nuclei: Environment variable disclosure via Response-Derived DSL Expressions CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-41646 · CVE Program
- CVE-2026-41646 · NVD
- FIRST EPSS
- GHSA-29rg-wmcw-hpf4 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-41646 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences