CVE-2026-76802: falha de média gravidade em projectdiscovery nuclei
Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.7epss 0.2%
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template signature check before accepting a template that contains both a fuzzing: block and an unsigned code: block. When an operator enables -dast, an untrusted multiprotocol template can place an unsigned code request into the execution queue and run arbitrary shell commands even without -code or a valid cryptographic signature. The issue affects CLI DAST scans and SDK integrations that enable DAST while accepting attacker-supplied templates. This issue is fixed in version 3.10.0.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Produtos afetados
projectdiscovery · nucleiCVEs relacionadas — projectdiscovery nuclei
No mesmo produto, das mais perigosas para as menos.
CVE-2024-43405HIGHNuclei Template Signature Verification BypassEPSS 1.1%CVE-2023-37896HIGHNuclei Path Traversal vulnerabilityEPSS 1.0%CVE-2024-27920HIGHUnsigned code template execution through workflows in projectdiscovery/nucleiEPSS 0.4%CVE-2026-76805MEDIUMNuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz ModeEPSS 0.4%CVE-2026-76803MEDIUMNuclei: Local File Read via MySQL Client Sandbox BypassEPSS 0.4%CVE-2026-41645MEDIUMNuclei: Environment variable disclosure via Response-Derived DSL ExpressionsEPSS 0.4%