Arbitrary Code Execution Vulnerability in Nuclei Vulnerability Scanner

CVE-2024-40641

Summary

The Nuclei vulnerability scanner, developed by Project Discovery, is affected by a significant flaw that allows the execution of arbitrary commands due to improper handling of code templates. Specifically, users may exploit this vulnerability within web applications that inherit from Nuclei and facilitate user-edited workflow files without enforcing necessary restrictions via the -code option. This vulnerability poses a risk as it enables users to execute potentially malicious commands, affecting system integrity. The issue has been rectified in version 3.3.0, and users are strongly encouraged to upgrade their installations to mitigate risks, as there are no viable workarounds available to address this issue.

References