Executive brief
Nuclei is a vulnerability scanning tool used by security teams to identify weaknesses in applications and infrastructure. A flaw in its DAST (dynamic application security testing) mode allows attackers to bypass the cryptographic signature requirement that normally prevents arbitrary code execution from untrusted templates. An attacker who can supply templates to a user running DAST scans can execute arbitrary shell commands on the scanning system.
Technical details
The vulnerability is a code path bypass in Nuclei's template loader. The product requires `code:` protocol templates to be cryptographically signed before execution to prevent arbitrary command execution. However, when a template combines a `fuzzing:` block (triggering DAST-eligible logic) with an unsigned `code:` block, the DAST loader branch accepts the template without verifying signatures, bypassing the signature check present in the normal loading path. The attack requires explicit `-dast` flag enablement and attacker-controlled or untrusted templates containing both fuzzing and code blocks. An authenticated attacker or template supplier can achieve arbitrary shell command execution with the privileges of the Nuclei process. The fix is available in Nuclei v3.10.0 via patch https://github.com/projectdiscovery/nuclei/pull/7472.
Affected products
- ProjectDiscovery Nuclei before 3.10.0
Timeline
- 2026-09-22: disclosed
- 2026-09-22: patched: Fixed in Nuclei v3.10.0