CVE-2026-76802
Received Received - Intake

Template Injection in Nuclei Scanner via Unsigned DAST Templates

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template signature check before accepting a template that contains both a fuzzing: block and an unsigned code: block. When an operator enables -dast, an untrusted multiprotocol template can place an unsigned code request into the execution queue and run arbitrary shell commands even without -code or a valid cryptographic signature. The issue affects CLI DAST scans and SDK integrations that enable DAST while accepting attacker-supplied templates. This issue is fixed in version 3.10.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-76802
EUVD
EUVD-2026-84556

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
projectdiscovery nuclei From 3.0.0 (inc) to 3.10.0 (exc)
projectdiscovery nuclei 3.10.0
projectdiscovery nuclei From 3.0.0 (inc) to 3.10.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Nuclei allows unsigned code templates to execute when the -dast flag is enabled. Normally, Nuclei requires cryptographic signatures for code templates, but a flaw in versions 3.0.0 to 3.10.0 bypasses this check if a template contains both a fuzzing block and an unsigned code block. This enables arbitrary shell command execution from untrusted templates without requiring the -code flag or a valid signature.

Detection Guidance

To detect this vulnerability, check if you are running Nuclei versions between 3.0.0 and 3.9.0. Verify if DAST templates with both fuzzing: and code: blocks are being used. Inspect logs for unauthorized command execution during DAST scans.

Impact Analysis

If you run Nuclei with the -dast flag and use untrusted templates containing both fuzzing and unsigned code blocks, an attacker could execute arbitrary shell commands on your system. This requires user interaction to load the malicious template but could lead to system compromise, data theft, or further network attacks depending on the executed commands.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating compliance requirements for data protection (GDPR) and healthcare data security (HIPAA) by allowing access to sensitive systems or data. Organizations using affected Nuclei versions for security testing may inadvertently introduce risks that breach regulatory controls.

Mitigation Strategies

Upgrade Nuclei to version 3.10.0 or later immediately. Disable DAST scans using untrusted templates until updated. Review and remove any templates containing both fuzzing: and code: blocks from untrusted sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76802. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart