ProjectDiscovery Nuclei CVE-2026-76805

Exploitation requires a specific, non-default combination on the SCANNER host: (1) the operator must run a multi-step DAST or fuzz template, (2) that template must reuse response data through an internal:true extractor, and (3) the operator must explicitly enable environment-variable expansion via the -env-vars flag. The attacker must control the scan target so it can return marker-shaped content that resolves against the template variable map. Limiting factors: users who do NOT enable -env-vars are not affected by the sensitive-information disclosure; user interaction is required (an operator must initiate the scan against the malicious target); and the AC:H chain (aligning the internal extractor output with the second-pass re-evaluation) makes casual exploitation unlikely. Affects Nuclei 3.0.0 through versions before 3.10.0.

This is a moderate-risk, tightly-gated information-disclosure flaw that should not be treated as a broad emergency. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N = 5.3) is internally consistent with the described attack: network vector because the malicious payload arrives in an HTTP response, AC:H because the attacker must line up a specific chain (multi-step DAST/fuzz template + internal:true extractor + the marker-shaped response resolving against the template variable map), and UI:R because a human operator must launch the scan against the attacker-controlled target. C:H with I:N/A:N is correct - the only impact is disclosure of scanner-host environment variables (credentials, API keys, tokens). No EPSS score, no CISA KEV entry, and no public POC were supplied, so exploitation status is 'no public exploit identified at time of analysis.' The high complexity plus the hard requirement that the operator explicitly enable -env-vars means real-world exploitability is narrow rather than opportunistic; the confidentiality impact is genuinely high only for that specific misconfiguration. The most important nuance is that this is explicitly an INCOMPLETE FIX of CVE-2026-41645 - the prior patch made expressions.Evaluate() single-pass within one call but left the DAST/fuzz caller re-evaluating substituted output - which raises the priority for anyone who believed 41645 fully closed the double-evaluation class. Net: a real, credible issue worth patching for teams that fuzz untrusted targets with -env-vars, but not a high-urgency, mass-exploited priority.

An attacker who controls a target web application waits to be scanned by a Nuclei operator running a multi-step DAST/fuzz template with -env-vars enabled. The malicious server returns marker-shaped content that an internal:true extractor captures in one protocol step; on the second evaluation pass in a later fuzz step, that captured content is reinterpreted as template syntax and resolves against the template variable map, echoing the scanner host's environment variables (credentials, API keys, tokens) back to the attacker. No public POC was provided, and the chain's high complexity plus mandatory operator opt-in to environment-variable expansion limit practical exploitation.