CVE-2026-41645: CWE-94: Improper Control of Generation of Code ('Code Injection') in projectdiscovery nuclei
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's expression evaluation engine makes it possible for a malicious target server to inject and execute supported DSL expressions. This happens when HTTP response data containing helper/function syntax gets reused by multi-step templates. If the -env-vars / -ev option is explicitly enabled, this can expose host environment variables. That option is off by default, so standard configurations are not affected by the information disclosure risk. This issue has been patched in version 3.8.0.
AI Analysis
Technical Summary
Nuclei, a YAML-based vulnerability scanner, has a code injection vulnerability (CWE-94) in its expression evaluation engine affecting versions 3.0.0 through before 3.8.0. The flaw allows a malicious target server to inject and execute supported DSL expressions when HTTP response data containing helper/function syntax is reused in multi-step templates. This can lead to information disclosure of host environment variables if the -env-vars / -ev option is explicitly enabled. Since this option is off by default, standard configurations are not affected by the information disclosure risk. The vulnerability has been patched in version 3.8.0.
Potential Impact
The vulnerability enables a malicious target server to inject and execute code within Nuclei's DSL expression engine, potentially exposing host environment variables if the -env-vars / -ev option is enabled. This can lead to information disclosure but does not affect integrity or availability. The CVSS score of 5.3 reflects a medium severity impact with network attack vector, high attack complexity, no privileges required, and user interaction needed.
Mitigation Recommendations
Upgrade Nuclei to version 3.8.0 or later, where this vulnerability has been patched. If upgrading immediately is not possible, ensure that the -env-vars / -ev option remains disabled (the default setting) to avoid exposure of host environment variables. No other mitigations are specified or required.
CVE-2026-41645: CWE-94: Improper Control of Generation of Code ('Code Injection') in projectdiscovery nuclei
Description
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's expression evaluation engine makes it possible for a malicious target server to inject and execute supported DSL expressions. This happens when HTTP response data containing helper/function syntax gets reused by multi-step templates. If the -env-vars / -ev option is explicitly enabled, this can expose host environment variables. That option is off by default, so standard configurations are not affected by the information disclosure risk. This issue has been patched in version 3.8.0.
CVSS v3.1
Score 5.3medium
Affected software
pkg:github/projectdiscovery/nucleiRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Nuclei, a YAML-based vulnerability scanner, has a code injection vulnerability (CWE-94) in its expression evaluation engine affecting versions 3.0.0 through before 3.8.0. The flaw allows a malicious target server to inject and execute supported DSL expressions when HTTP response data containing helper/function syntax is reused in multi-step templates. This can lead to information disclosure of host environment variables if the -env-vars / -ev option is explicitly enabled. Since this option is off by default, standard configurations are not affected by the information disclosure risk. The vulnerability has been patched in version 3.8.0.
Potential Impact
The vulnerability enables a malicious target server to inject and execute code within Nuclei's DSL expression engine, potentially exposing host environment variables if the -env-vars / -ev option is enabled. This can lead to information disclosure but does not affect integrity or availability. The CVSS score of 5.3 reflects a medium severity impact with network attack vector, high attack complexity, no privileges required, and user interaction needed.
Mitigation Recommendations
Upgrade Nuclei to version 3.8.0 or later, where this vulnerability has been patched. If upgrading immediately is not possible, ensure that the -env-vars / -ev option remains disabled (the default setting) to avoid exposure of host environment variables. No other mitigations are specified or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-21T23:58:43.802Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69fd5dbdcbff5d86108b643f
Added to database: 05/08/2026, 03:51:25 UTC
Last enriched: 05/15/2026, 10:42:20 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 66
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.