CVE-2026-76802 in Nuclei
Summary
by MITRE • 09/22/2026
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template signature check before accepting a template that contains both a fuzzing: block and an unsigned code: block. When an operator enables -dast, an untrusted multiprotocol template can place an unsigned code request into the execution queue and run arbitrary shell commands even without -code or a valid cryptographic signature. The issue affects CLI DAST scans and SDK integrations that enable DAST while accepting attacker-supplied templates. This issue is fixed in version 3.10.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified within the Nuclei vulnerability scanner, specifically affecting versions from 3.0.0 through 3.10.0, represents a critical logic flaw in the Dynamic Application Security Testing template loading mechanism. This issue stems from an incomplete validation process where the application fails to enforce cryptographic signature verification for templates that combine specific functional blocks. In normal operation, Nuclei relies on signed code templates to ensure integrity and authenticity before execution. However, when a template contains both a fuzzing block and an unsigned code block, the scanner incorrectly bypasses the standard unsigned code-template signature check. This oversight allows malicious actors to inject arbitrary shell commands into the execution queue by crafting a multiprotocol DAST template that exploits this specific combination of features, effectively circumventing security controls designed to prevent unauthorized code execution.
From a technical perspective, the root cause lies in the conditional logic governing how Nuclei processes different types of requests within its DSL-based framework. When an operator enables the -dast flag for dynamic scanning or when SDK integrations activate DAST capabilities while accepting user-supplied templates, the scanner prioritizes certain template structures over security checks. The flaw permits an untrusted source to place a request containing unsigned code into the execution queue without requiring the -code flag or a valid cryptographic signature. This behavior contradicts the principle of least privilege and secure by design, as it allows arbitrary command injection under conditions where such access should be strictly prohibited unless explicitly authorized via proper signing mechanisms. The vulnerability is particularly dangerous because it can be triggered through standard DAST workflows that are commonly used in automated security pipelines.
The operational impact of this vulnerability is severe, enabling remote code execution on the host system running Nuclei. An attacker who controls or influences the template source could execute arbitrary shell commands with the privileges of the user running the scanner. This poses significant risks to CI/CD environments where templates are frequently downloaded from community repositories or third-party sources. If a malicious actor publishes a compromised template that includes both fuzzing and unsigned code blocks, any organization using vulnerable versions of Nuclei in their DAST scans could inadvertently execute harmful commands during routine security assessments. The risk is amplified in automated pipelines where human oversight may be limited, potentially leading to data exfiltration, system compromise, or lateral movement within the network infrastructure dependent on these scanning tools.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and CWE-20 Improper Input Validation, as it involves failing to validate input against expected constraints before processing. In terms of MITRE ATT&CK mapping, this flaw facilitates T1059 Command and Scripting Interpreter abuse, allowing attackers to execute commands via the shell environment compromised through the scanner itself. It also relates to T1195 Supply Chain Compromise if exploited by injecting malicious templates into trusted template repositories or distribution channels. The exploitation vector primarily targets DAST workflows where external inputs are processed without sufficient integrity checks, highlighting the importance of rigorous validation in security tooling that handles untrusted data sources.
To mitigate this risk, organizations must immediately upgrade to Nuclei version 3.10.0 or later, which addresses the logic flaw by ensuring that signature verification is consistently applied regardless of template structure. For environments where upgrading is not immediately feasible, operators should disable DAST mode when processing untrusted templates and avoid using -dast flags in conjunction with community-sourced content until patches are verified. Additionally implementing strict allowlists for trusted template sources can reduce exposure to malicious inputs. Security teams should also audit their CI/CD pipelines to ensure that no vulnerable versions of Nuclei remain active in production or staging environments, thereby preventing potential exploitation through automated scanning routines. Regular updates and adherence to vendor-recommended configurations are essential to maintaining the integrity of vulnerability management processes against such logic-based exploits.