EUVD-2026-80901
GHSA-77rj-h8wx-6cgq
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needs local write access to template files (AV:L, PR:L) and the victim must run a scan (UI:R); successful bypass yields arbitrary OS command execution, so C/I/A all High.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.
AnalysisAI
Local attackers with write access to Nuclei's on-disk template storage can bypass template signature verification and cause arbitrary operating system commands to execute from a tampered template in ProjectDiscovery Nuclei versions before 3.11.1 (reported as 3.7.0 through 3.10.x). The root cause is CWE-347: cached signature-verification results were keyed only on a template file's modification time, so an attacker can swap a previously verified template for unsigned malicious content and restore the original mtime to have the stale 'verified' result reused under the default configuration where unsigned templates are disabled. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires: (1) local write access to Nuclei's on-disk templates so the attacker can replace file contents and reset mtime via a Chtimes-style call; (2) the target template must have been previously signature-verified and cached (IndexVersion 1 metadata keyed on ModTime); (3) Nuclei must run against the tampered template with signature verification active (the default, DisableUnsignedTemplates=false), using the javascript/code protocol that executes OS commands; and (4) a victim actually invoking a scan (UI:P). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but access-gated supply-chain integrity flaw, not a remotely-wormable emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Nuclei 3.11.1, the version in which the metadata index (IndexVersion 2) records a VerifierFingerprint and ContentDigest so that a cached verification verdict can only be reused when the template content still matches what was originally signed; the corresponding upstream commit is 9de96e4dda5a03da963b9ae6582f03ea55791a76 and the advisory is at https://www.vulncheck.com/advisories/nuclei-from-3.7.0-before-3.11.1-template-signature-bypass-via-modification-time-only-cache, with engineering detail in issue https://github.com/projectdiscovery/nuclei/issues/7663. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployments of ProjectDiscovery Nuclei to identify any instances running versions 3.7.0 through 3.10.x and upgrade them to version 3.11.1; if immediate upgrade is not feasible, restrict filesystem write access to the template storage directory to only trusted administrators and temporarily disable scanning against templates from untrusted sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Nuclei is a vulnerability scanner powered by YAML based templates. Rated high severity (CVSS 7.8), this vulnerability is
Nuclei is a vulnerability scanner. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authen
projectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL. Rated high seve
DSL expression injection in ProjectDiscovery Nuclei before 3.8.0 allows remote code execution when using the -env-vars f
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today