What’s Vulnerable › Vulnerabilities

CVE-2026-41646: Nuclei: Local File Read via require() Module Loader Bypass

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-08 · updated 2026-10-26
• Weakness: CWE-284

Description

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require() function, bypassing the default local file access restriction. This issue has been patched in version 3.8.0.

Affected products

• projectdiscovery nuclei: from 3.0.0 before 3.8.0 — fixed in 3.8.0

How to fix

Upgrade to a fixed version: projectdiscovery nuclei 3.8.0. Check the vendor advisory for mitigations.

References

• https://github.com/projectdiscovery/nuclei/commit/6f2ade6a9b427c284c15a43445f9c7f055e60e5d
• https://github.com/projectdiscovery/nuclei/pull/7332
• https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-29rg-wmcw-hpf4
• https://github.com/projectdiscovery/nuclei/pull/7332

Get alerted when CVE-2026-41646 or the next vulnerability affects your stack