# CVE-2026-76802: ProjectDiscovery Nuclei arbitrary command execution in DAST template loading

Source: https://junglewise.ai/threats/cve-2026-76802-projectdiscovery-nuclei-arbitrary-command-execution-in-dast  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76802 · Severity: medium · CVSS 4.7 · Published 2026-09-22

Nuclei is a vulnerability scanning tool used by security teams to identify weaknesses in applications and infrastructure. A flaw in its DAST (dynamic application security testing) mode allows attackers to bypass the cryptographic signature requirement that normally prevents arbitrary code execution from untrusted templates. An attacker who can supply templates to a user running DAST scans can execute arbitrary shell commands on the scanning system.

Technologies: [github.com/projectdiscovery/nuclei (Go)](https://junglewise.ai/threats/technologies/github-com-projectdiscovery-nuclei), [github.com/projectdiscovery/nuclei/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-projectdiscovery-nuclei-v2), [github.com/projectdiscovery/nuclei/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-projectdiscovery-nuclei-v3), [ProjectDiscovery Nuclei](https://junglewise.ai/threats/technologies/nuclei). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [ProjectDiscovery](https://junglewise.ai/threats/vendors/projectdiscovery).

## Quick answers

**Is CVE-2026-76802 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76802 being exploited in the wild.

**How severe is CVE-2026-76802?** Medium severity, with a CVSS score of 4.7, published 22 September 2026.

**Which products and versions are affected?** github.com/projectdiscovery/nuclei (Go) SEMVER:introduced=0; github.com/projectdiscovery/nuclei/v2 (Go) SEMVER:introduced=0; github.com/projectdiscovery/nuclei/v3 (Go) >= 3.0.0, < 3.10.0, SEMVER:introduced=3.0.0,fixed=3.10.0; ProjectDiscovery Nuclei before 3.10.0.

**Is there a fix for CVE-2026-76802?** Yes. github.com/projectdiscovery/nuclei/v3 (Go): upgrade to 3.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76802 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-76802?** Check whether you run github.com/projectdiscovery/nuclei (Go), github.com/projectdiscovery/nuclei/v2 (Go), github.com/projectdiscovery/nuclei/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/projectdiscovery/nuclei/v3 (Go): upgrade to 3.10.0 or later

  ```sh
  go get github.com/projectdiscovery/nuclei/v3@v3.10.0
  ```


## Technical details

The vulnerability is a code path bypass in Nuclei's template loader. The product requires `code:` protocol templates to be cryptographically signed before execution to prevent arbitrary command execution. However, when a template combines a `fuzzing:` block (triggering DAST-eligible logic) with an unsigned `code:` block, the DAST loader branch accepts the template without verifying signatures, bypassing the signature check present in the normal loading path. The attack requires explicit `-dast` flag enablement and attacker-controlled or untrusted templates containing both fuzzing and code blocks. An authenticated attacker or template supplier can achieve arbitrary shell command execution with the privileges of the Nuclei process. The fix is available in Nuclei v3.10.0 via patch https://github.com/projectdiscovery/nuclei/pull/7472.

## Affected products

- ProjectDiscovery Nuclei before 3.10.0

## Identifiers

- CVE-2026-76802
- GHSA-jpf4-98qj-qr67
- GO-2026-6570

## Timeline

- 2026-09-22: disclosed
- 2026-09-22: patched: Fixed in Nuclei v3.10.0

## Related threats

- [Rejected reason: Further research determined the issue results from a dependency.](https://junglewise.ai/threats/cve-2026-76819-projectdiscovery-nuclei-arbitrary-code-execution-via-goja)
- [Nuclei environment variable disclosure in DAST/Fuzz mode](https://junglewise.ai/threats/cve-2026-76805-nuclei-environment-variable-disclosure-in-dast-fuzz-mode)
- [ProjectDiscovery Nuclei security gate bypass via workflow file-protocol templates](https://junglewise.ai/threats/cve-2026-76804-projectdiscovery-nuclei-security-gate-bypass-via-workflow-file)
- [ProjectDiscovery Nuclei local file read via MySQL sandbox bypass](https://junglewise.ai/threats/cve-2026-76803-projectdiscovery-nuclei-local-file-read-via-mysql-sandbox-bypass)
- [Projectdiscovery Nuclei template signature verification bypass via modification time spoofing](https://junglewise.ai/threats/cve-2026-92718-projectdiscovery-nuclei-template-signature-verification-bypass)