What’s Vulnerable › Vulnerabilities

CVE-2026-41645: Nuclei: Environment variable disclosure via Response-Derived DSL Expressions

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-08 · updated 2026-10-26
• Weakness: CWE-94

Description

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's expression evaluation engine makes it possible for a malicious target server to inject and execute supported DSL expressions. This happens when HTTP response data containing helper/function syntax gets reused by multi-step templates. If the -env-vars / -ev option is explicitly enabled, this can expose host environment variables. That option is off by default, so standard configurations are not affected by the information disclosure risk. This issue has been patched in version 3.8.0.

Affected products

• projectdiscovery nuclei: from 3.0.0 before 3.8.0 — fixed in 3.8.0

How to fix

Upgrade to a fixed version: projectdiscovery nuclei 3.8.0. Check the vendor advisory for mitigations.

References

• https://github.com/projectdiscovery/nuclei/commit/6c803c74d193f85f8a6d9803ce493fd302cad0eb
• https://github.com/projectdiscovery/nuclei/commit/d2217320162d5782ca7cb95bef9dda17063818f3
• https://github.com/projectdiscovery/nuclei/pull/7221
• https://github.com/projectdiscovery/nuclei/pull/7321
• https://github.com/projectdiscovery/nuclei/releases/tag/v3.8.0
• https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jm34-66cf-qpvr

Get alerted when CVE-2026-41645 or the next vulnerability affects your stack