Expression Injection Vulnerability in ProjectDiscovery Nuclei
CVE-2026-41282

4MEDIUM

Key Information:

Vendor

Projectdiscovery
Status
Nuclei
Vendor
CVE Published:
20 April 2026

What is CVE-2026-41282?

A vulnerability in ProjectDiscovery Nuclei versions before 3.8.0 allows attackers to perform DSL expression injection. This primarily affects the usage of -env-vars in multi-step templates, especially when applied to untrusted targets, making it crucial for users to evaluate their environment settings to ensure security.

Affected Version(s)

Nuclei 3.0.0 < 3.8.0

References

https://github.com/projectdiscovery/nuclei/security/advis...
https://github.com/projectdiscovery/nuclei/pull/7221
https://github.com/projectdiscovery/nuclei/pull/7321

CVSS V3.1

Score:
4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.