Nuclei versions 3.0.0 up to but not including 3.8.0 contain a vulnerability in the expression evaluation engine that can lead to environment variable disclosure. This occurs when the '-env-vars' ('-ev') option is explicitly enabled, allowing malicious HTTP response data to inject and execute DSL expressions that expose host environment variables. The option is off by default, so typical configurations are not affected. The issue is fixed in version 3.8.0.