Vulnerability record · CVE-2026-41646 · published 8 May 2026

CVE-2026-41646: Projectdiscovery nuclei improper access control vulnerability

Projectdiscovery · Nuclei

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require() function, bypassing the default local file access restriction. This issue has been patched in version 3.8.0.

5.5 CVSS 3.1 Medium EPSS 0.16% · top 95.7% CWE-284 · Improper access control

5.5CVSS 3.1 base score

0.16%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Nuclei Projectdiscovery

References

Link	Tags
https://github.com/projectdiscovery/nuclei/commit/6f2ade6a9b427c284c15a43445f9c7f055e60e5d	Patch
https://github.com/projectdiscovery/nuclei/pull/7332	Issue TrackingPatch
https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-29rg-wmcw-hpf4	MitigationPatchVendor Advisory
https://github.com/projectdiscovery/nuclei/pull/7332	Issue TrackingPatch

Track CVE-2026-41646 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2024-43405Projectdiscovery nuclei os command injection vulnerabilityNuclei is a vulnerability scanner powered by YAML based templates. Starting in version 3.0.0 and prior to version 3.3.2, a vulnerability in Nuclei's …EPSS 1.1%4 Sep 2024 7.5CVE-2026-41282Projectdiscovery nuclei code injection vulnerabilityProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untrusted targ…EPSS 0.43%20 Apr 2026 7.5CVE-2023-37896Projectdiscovery nuclei path traversal vulnerabilityNuclei is a vulnerability scanner. Prior to version 2.9.9, a security issue in the Nuclei project affected users utilizing Nuclei as Go code (SDK) ru…EPSS 1.0%4 Aug 2023 7.4CVE-2024-27920Projectdiscovery nuclei os command injection vulnerabilityprojectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL. A significant security oversight was identif…EPSS 0.41%15 Mar 2024 5.3CVE-2026-41645Projectdiscovery nuclei code injection vulnerabilityNuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's expressio…EPSS 0.44%8 May 2026 7.8CVE-2026-81963Windows Update Stack link-following privilege escalationWindows Update Stack resolves links improperly before accessing files, a link-following flaw (CWE-59) compounded by improper access control (CWE-284)…KEVEPSS 0.39%analysed8 Sep 2026 10.0CVE-2026-21962Oracle HTTP Server and WebLogic Proxy Plug-in improper access controlOracle HTTP Server and the WebLogic Server Proxy Plug-in (for Apache HTTP Server and IIS) contain an improper access control flaw (CWE-284) in suppor…KEVEPSS 71%analysed20 Jan 2026 10.0CVE-2026-34908Ubiquiti UniFi OS improper access control allows unauthorized system changesUniFi OS devices contain an improper access control flaw (CWE-284) that lets a network-reachable actor make unauthorized changes to the system. The C…KEVEPSS 15%analysed22 May 2026

Source: NIST National Vulnerability Database (record CVE-2026-41646), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.