PT-2026-34613 · Nuclei · Nuclei

Akashhamal0X01 · Published 2026-04-22 · Updated 2026-05-20 · CVE-2026-41646

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nuclei versions 3.0.0 through 3.7.9

Description A flaw in the JavaScript protocol runtime's module loading system allows JavaScript templates to read local .js and .json files from the host filesystem. This occurs because the require() function utilizes a default host filesystem loader that bypasses the allow-local-file-access check, which is intended to restrict file access outside the template directory. This can lead to the exposure of sensitive data stored in JSON configuration files, such as package.json, credential stores, or cloud configuration files. The issue specifically affects CLI users running untrusted third-party templates and SDK users who allow end-users to supply JavaScript templates.

Recommendations Update to version 3.8.0. Avoid running JavaScript templates from unverified or untrusted sources.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-41646

GHSA-29RG-WMCW-HPF4

GO-2026-4965

Affected Products

Nuclei

References · 11

• 🔥 https://github.com/projectdiscovery/nuclei/pull/7332 · Exploit
• https://github.com/projectdiscovery/nuclei/commit/6f2ade6a9b427c284c15a43445f9c7f055e60e5d · Patch
• https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-29rg-wmcw-hpf4 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4965 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-29rg-wmcw-hpf4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41646 · Security Note
• https://github.com/projectdiscovery/nuclei · Note
• https://t.me/cveNotify/162664 · Telegram Post
• https://twitter.com/CVEarity/status/2052787141361717704 · Twitter Post
• https://twitter.com/CVEnew/status/2053559127897518203 · Twitter Post
• https://t.me/CVEtracker/53056 · Telegram Post