Nuclei CVE-2026-41282

Exploitation requires three specific, non-default conditions to be simultaneously true: (1) The Nuclei operator must explicitly enable the -env-vars flag (not the default configuration), (2) the target being scanned must be untrusted or attacker-controlled such that the attacker can inject malicious response data, and (3) multi-step templates must be used (single-step templates are not affected). Additionally, the attacker must craft injection payloads matching Nuclei's specific DSL expression syntax to break out of the variable context. The CVSS vector AV:N/AC:H reflects that while network access is possible, the attack complexity is high due to these prerequisites. Environments running Nuclei with default settings (without -env-vars), scanning only trusted infrastructure, or using only single-step templates are NOT vulnerable regardless of version.

CVSS 4.0 with AV:N/AC:H indicates network-accessible but high attack complexity, providing initial risk guidance. However, CVSS alone significantly overstates real-world risk due to multiple limiting factors explicitly confirmed in the description: (1) The -env-vars flag must be explicitly enabled (non-default configuration), (2) multi-step templates must be used, (3) the attacker must control untrusted target responses, and (4) AC:H suggests the injection requires precise conditions or multiple attempts. The KEV and EPSS data are not provided, but the GitHub advisory and patch availability indicate vendor awareness and remediation. The actual attack surface is substantially narrower than a CVSS 4.0 score suggests - this affects security teams running Nuclei in automated scanning pipelines against untrusted or compromised targets with -env-vars enabled, not all Nuclei installations. Organizations using Nuclei without -env-vars or only against trusted infrastructure face minimal risk. No active exploitation is confirmed at time of analysis.

An attacker operates a web server hosting a malicious application that Nuclei is configured to scan as an untrusted target using multi-step templates with -env-vars enabled. When Nuclei executes the template, the attacker crafts HTTP responses containing DSL payload injection sequences (e.g., ${system('id')} or similar expression syntax) that are stored in environment variables during template execution. The DSL parser evaluates these injected expressions as code, executing arbitrary commands on the scanner's system. The attack complexity is high because the attacker must precisely match the template's variable interpolation syntax and timing, and the Nuclei operator must be actively scanning with non-default configuration.