CVE-2026-41645 Details
Description
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's expression evaluation engine makes it possible for a malicious target server to inject and execute supported DSL expressions. This happens when HTTP response data containing helper/function syntax gets reused by multi-step templates. If the -env-vars / -ev option is explicitly enabled, this can expose host environment variables. That option is off by default, so standard configurations are not affected by the information disclosure risk. This issue has been patched in version 3.8.0.
A vulnerability exists in the Nuclei vulnerability scanner, specifically in versions 3.0.0 prior to 3.8.0. The issue arises in the expression evaluation engine, where a malicious target server can inject and execute DSL expressions. This vulnerability is triggered when HTTP response data containing helper or function syntax is reused by multi-step templates. If the '-env-vars' or '-ev' option is enabled, this can lead to the exposure of host environment variables. However, this option is off by default, so standard configurations are not at risk. The vulnerability has been patched in version 3.8.0.
Upgrade to Nuclei version 3.8.0, which addresses the vulnerability by changing the evaluation logic to only process template-authored expressions and prevent the reinterpretation of response-derived values.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| projectdiscovery nuclei | >= 3.0.0, < 3.8.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | New CVE Received | [email protected] |