CVE-2026-41645

MEDIUM 5.3

Nuclei: Environment variable disclosure via Response-Derived DSL Expressions

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's expression evaluation engine makes it possible for a malicious target server to inject and execute supported DSL expressions. This happens when HTTP response data containing helper/function syntax gets reused by multi-step templates. If the -env-vars / -ev option is explicitly enabled, this can expose host environment variables. That option is off by default, so standard configurations are not affected by the information disclosure risk. This issue has been patched in version 3.8.0.

CWE	CWE-94
Vendor	projectdiscovery
Product	nuclei
Published	May 8, 2026

Stay Ahead of the Next One

Get instant alerts for projectdiscovery nuclei

Be the first to know when new medium vulnerabilities affecting projectdiscovery nuclei are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

projectdiscovery / nuclei

>= 3.0.0, < 3.8.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jm34-66cf-qpvr github.com: https://github.com/projectdiscovery/nuclei/pull/7221 github.com: https://github.com/projectdiscovery/nuclei/pull/7321 github.com: https://github.com/projectdiscovery/nuclei/commit/6c803c74d193f85f8a6d9803ce493fd302cad0eb github.com: https://github.com/projectdiscovery/nuclei/commit/d2217320162d5782ca7cb95bef9dda17063818f3 github.com: https://github.com/projectdiscovery/nuclei/releases/tag/v3.8.0