VULNERABILITY INTELLIGENCE

CVE-2026-41646

CVSS score5.5 MEDIUM
EPSS probability0.11%
CISA KEVNot currently listed
Published2026-05-08
Last modified2026-10-26
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Description

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require() function, bypassing the default local file access restriction. This issue has been patched in version 3.8.0.

Weakness classification

  • security-advisories@github.com: CWE-284

Primary references