Vulnerability · Published May 8, 2026 · Assigned by GitHub_M
CVE-2026-41646Nuclei: Local File Read via require() Module Loader Bypass
Medium 5.5
In plain English
A medium-severity improper access control in nuclei from projectdiscovery. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require() function, bypassing the default local file access restriction. This issue has been patched in version 3.8.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/projectdiscovery/nuclei | no fix listed | GO-2026-4965 |
| Go | github.com/projectdiscovery/nuclei/v2 | no fix listed | GO-2026-4965 |
| Go | github.com/projectdiscovery/nuclei/v3 | 3.8.0 | GHSA-29rg-wmcw-hpf4 |
| Go | github.com/projectdiscovery/nuclei/v3 | 3.8.0 | GO-2026-4965 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| projectdiscovery | nuclei | >= 3.0.0, < 3.8.0 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N