CVE-2026-41645

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41645", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-21T23:58:43.802Z", "datePublished": "2026-05-08T03:17:19.302Z", "dateUpdated": "2026-05-11T18:16:02.582Z"}, "containers": {"cna": {"title": "Nuclei: Environment variable disclosure via Response-Derived DSL Expressions", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jm34-66cf-qpvr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jm34-66cf-qpvr"}, {"name": "https://github.com/projectdiscovery/nuclei/pull/7221", "tags": ["x_refsource_MISC"], "url": "https://github.com/projectdiscovery/nuclei/pull/7221"}, {"name": "https://github.com/projectdiscovery/nuclei/pull/7321", "tags": ["x_refsource_MISC"], "url": "https://github.com/projectdiscovery/nuclei/pull/7321"}, {"name": "https://github.com/projectdiscovery/nuclei/commit/6c803c74d193f85f8a6d9803ce493fd302cad0eb", "tags": ["x_refsource_MISC"], "url": "https://github.com/projectdiscovery/nuclei/commit/6c803c74d193f85f8a6d9803ce493fd302cad0eb"}, {"name": "https://github.com/projectdiscovery/nuclei/commit/d2217320162d5782ca7cb95bef9dda17063818f3", "tags": ["x_refsource_MISC"], "url": "https://github.com/projectdiscovery/nuclei/commit/d2217320162d5782ca7cb95bef9dda17063818f3"}, {"name": "https://github.com/projectdiscovery/nuclei/releases/tag/v3.8.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/projectdiscovery/nuclei/releases/tag/v3.8.0"}], "affected": [{"vendor": "projectdiscovery", "product": "nuclei", "versions": [{"version": ">= 3.0.0, < 3.8.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T03:17:19.302Z"}, "descriptions": [{"lang": "en", "value": "Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's expression evaluation engine makes it possible for a malicious target server to inject and execute supported DSL expressions. This happens when HTTP response data containing helper/function syntax gets reused by multi-step templates. If the -env-vars / -ev option is explicitly enabled, this can expose host environment variables. That option is off by default, so standard configurations are not affected by the information disclosure risk. This issue has been patched in version 3.8.0."}], "source": {"advisory": "GHSA-jm34-66cf-qpvr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-11T18:15:43.322968Z", "id": "CVE-2026-41645", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T18:16:02.582Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41645", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T18:15:43.322968Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T18:15:47.931Z"}}], "cna": {"title": "Nuclei: Environment variable disclosure via Response-Derived DSL Expressions", "source": {"advisory": "GHSA-jm34-66cf-qpvr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "projectdiscovery", "product": "nuclei", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.8.0"}]}], "references": [{"url": "https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jm34-66cf-qpvr", "name": "https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jm34-66cf-qpvr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/projectdiscovery/nuclei/pull/7221", "name": "https://github.com/projectdiscovery/nuclei/pull/7221", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/projectdiscovery/nuclei/pull/7321", "name": "https://github.com/projectdiscovery/nuclei/pull/7321", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/projectdiscovery/nuclei/commit/6c803c74d193f85f8a6d9803ce493fd302cad0eb", "name": "https://github.com/projectdiscovery/nuclei/commit/6c803c74d193f85f8a6d9803ce493fd302cad0eb", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/projectdiscovery/nuclei/commit/d2217320162d5782ca7cb95bef9dda17063818f3", "name": "https://github.com/projectdiscovery/nuclei/commit/d2217320162d5782ca7cb95bef9dda17063818f3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/projectdiscovery/nuclei/releases/tag/v3.8.0", "name": "https://github.com/projectdiscovery/nuclei/releases/tag/v3.8.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's expression evaluation engine makes it possible for a malicious target server to inject and execute supported DSL expressions. This happens when HTTP response data containing helper/function syntax gets reused by multi-step templates. If the -env-vars / -ev option is explicitly enabled, this can expose host environment variables. That option is off by default, so standard configurations are not affected by the information disclosure risk. This issue has been patched in version 3.8.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T03:17:19.302Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41645", "state": "PUBLISHED", "dateUpdated": "2026-05-11T18:16:02.582Z", "dateReserved": "2026-04-21T23:58:43.802Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-08T03:17:19.302Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nuclei", "vendor": "projectdiscovery", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.8.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:projectdiscovery:nuclei:*:*:*:*:*:go:*:*", "matchCriteriaId": "9E442141-1965-481A-BE82-B6DC11B58EAC", "versionEndExcluding": "3.8.0", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's expression evaluation engine makes it possible for a malicious target server to inject and execute supported DSL expressions. This happens when HTTP response data containing helper/function syntax gets reused by multi-step templates. If the -env-vars / -ev option is explicitly enabled, this can expose host environment variables. That option is off by default, so standard configurations are not affected by the information disclosure risk. This issue has been patched in version 3.8.0."}, {"lang": "es", "value": "Nuclei es un esc\u00e1ner de vulnerabilidades construido sobre un DSL simple basado en YAML. Desde la versi\u00f3n 3.0.0 hasta antes de la versi\u00f3n 3.8.0, una vulnerabilidad en el motor de evaluaci\u00f3n de expresiones de Nuclei permite que un servidor objetivo malicioso inyecte y ejecute expresiones DSL compatibles. Esto ocurre cuando los datos de respuesta HTTP que contienen sintaxis de ayudante/funci\u00f3n son reutilizados por plantillas de varios pasos. Si la opci\u00f3n -env-vars / -ev est\u00e1 expl\u00edcitamente habilitada, esto puede exponer variables de entorno del host. Esa opci\u00f3n est\u00e1 desactivada por defecto, por lo que las configuraciones est\u00e1ndar no se ven afectadas por el riesgo de revelaci\u00f3n de informaci\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 3.8.0."}], "id": "CVE-2026-41645", "lastModified": "2026-10-26T20:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41645", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-11T18:15:43.322968Z", "version": "2.0.3"}}]}, "published": "2026-05-08T04:16:18.177", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/projectdiscovery/nuclei/commit/6c803c74d193f85f8a6d9803ce493fd302cad0eb"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/projectdiscovery/nuclei/commit/d2217320162d5782ca7cb95bef9dda17063818f3"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/projectdiscovery/nuclei/pull/7221"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/projectdiscovery/nuclei/pull/7321"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/projectdiscovery/nuclei/releases/tag/v3.8.0"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jm34-66cf-qpvr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.8.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "nuclei", "source": "cna", "vendor": "projectdiscovery"}, "product": "nuclei", "vendor": "projectdiscovery"}], "created": "2026-05-08T05:30:45.939524+00:00", "updated": "2026-05-08T05:30:46.223235+00:00", "vendors": ["projectdiscovery", "projectdiscovery$PRODUCT$nuclei"]}