Expression Evaluation Vulnerability in Nuclei by Project Discovery

CVE-2026-41645

What is CVE-2026-41645?

A vulnerability exists in the Nuclei vulnerability scanner's expression evaluation engine, affecting versions 3.0.0 through 3.7.x. It allows an attacker to exploit multi-step templates, potentially injecting and executing unsafe DSL expressions from HTTP response data. If the -env-vars or -ev option is enabled, sensitive host environment variables could be exposed. This setting is off by default, meaning standard configurations remain secure. The issue has been resolved in version 3.8.0, making system updates essential for enhanced security.

References