Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass
Published Sep 22, 2026
4.7
MEDIUMCVSS 3.1
EPSS 0.18%
Description
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template signature check before accepting a template that contains both a fuzzing: block and an unsigned code: block. When an operator enables -dast, an untrusted multiprotocol template can place an unsigned code request into the execution queue and run arbitrary shell commands even without -code or a valid cryptographic signature. The issue affects CLI DAST scans and SDK integrations that enable DAST while accepting attacker-supplied templates. This issue is fixed in version 3.10.0.
Affected products
-
- Version >= 3.0.0, < 3.10.0StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Projectdiscovery | Nuclei | n/a |
|
No data.
No data.
No Red Hat product state for this CVE.
github.com/projectdiscovery/nuclei/v3
Go
Introduced 3.0.0 Fixed 3.10.0github.com/projectdiscovery/nuclei/v2
Go
Introduced 0 Fixed not fixedgithub.com/projectdiscovery/nuclei
Go
Introduced 0 Fixed not fixed
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/projectdiscovery/nuclei/v3 | 3.0.0 | 3.10.0 |
| Go | github.com/projectdiscovery/nuclei/v2 | 0 | not fixed |
| Go | github.com/projectdiscovery/nuclei | 0 | not fixed |
Remediation
No remediation recorded yet.
References (6)
- https://github.com/advisories/GHSA-jpf4-98qj-qr67 Advisory
- https://github.com/projectdiscovery/nuclei/commit/1c440e755a97471c56fb0276ee8a8c4132974645 x_refsource_MISC
- https://github.com/projectdiscovery/nuclei/pull/7472 x_refsource_MISC
- https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0 x_refsource_MISC
- https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jpf4-98qj-qr67 x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2026-76802
| Link | Providers | Tags |
|---|---|---|
| https://github.com/advisories/GHSA-jpf4-98qj-qr67 | Advisory | |
| https://github.com/projectdiscovery/nuclei/commit/1c440e755a97471c56fb0276ee8a8c4132974645 | x_refsource_MISC | |
| https://github.com/projectdiscovery/nuclei/pull/7472 | x_refsource_MISC | |
| https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0 | x_refsource_MISC | |
| https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jpf4-98qj-qr67 | x_refsource_CONFIRM | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-76802 |
Change history (0)
No recorded changes yet.