Is CVE-2026-76803 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76803 being exploited in the wild.

How severe is CVE-2026-76803?

Medium severity, with a CVSS score of 5.3, published 22 September 2026.

Which products and versions are affected?

github.com/projectdiscovery/nuclei (Go) SEMVER:introduced=0; github.com/projectdiscovery/nuclei/v2 (Go) SEMVER:introduced=0; github.com/projectdiscovery/nuclei/v3 (Go) >= 3.0.0, < 3.10.0, SEMVER:introduced=3.0.0,fixed=3.10.0; ProjectDiscovery Nuclei before 3.10.0.

Is there a fix for CVE-2026-76803?

Yes. github.com/projectdiscovery/nuclei/v3 (Go): upgrade to 3.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76803 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-76803?

Check whether you run github.com/projectdiscovery/nuclei (Go), github.com/projectdiscovery/nuclei/v2 (Go), github.com/projectdiscovery/nuclei/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76803: ProjectDiscovery Nuclei local file read via MySQL sandbox bypass

Q: Is there a fix for CVE-2026-76803?

Yes. github.com/projectdiscovery/nuclei/v3 (Go): upgrade to 3.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-76803 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-76803?

Check whether you run github.com/projectdiscovery/nuclei (Go), github.com/projectdiscovery/nuclei/v2 (Go), github.com/projectdiscovery/nuclei/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76803 · Severity: medium · CVSS 5.3 · Published 2026-09-22

Nuclei is a vulnerability scanner that uses templates to test systems for security issues. A flaw in its JavaScript MySQL client library allows untrusted templates to read arbitrary files on the scanner host by connecting to a malicious MySQL server, bypassing Nuclei's built-in filesystem access restrictions. This affects users running third-party templates against database targets.

Technologies: github.com/projectdiscovery/nuclei (Go), github.com/projectdiscovery/nuclei/v2 (Go), github.com/projectdiscovery/nuclei/v3 (Go), ProjectDiscovery Nuclei. Vendors: Go, ProjectDiscovery.

Quick answers

Is CVE-2026-76803 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76803 being exploited in the wild.
How severe is CVE-2026-76803?: Medium severity, with a CVSS score of 5.3, published 22 September 2026.
Which products and versions are affected?: github.com/projectdiscovery/nuclei (Go) SEMVER:introduced=0; github.com/projectdiscovery/nuclei/v2 (Go) SEMVER:introduced=0; github.com/projectdiscovery/nuclei/v3 (Go) >= 3.0.0, < 3.10.0, SEMVER:introduced=3.0.0,fixed=3.10.0; ProjectDiscovery Nuclei before 3.10.0.
Is there a fix for CVE-2026-76803?: Yes. github.com/projectdiscovery/nuclei/v3 (Go): upgrade to 3.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76803 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-76803?: Check whether you run github.com/projectdiscovery/nuclei (Go), github.com/projectdiscovery/nuclei/v2 (Go), github.com/projectdiscovery/nuclei/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/projectdiscovery/nuclei/v3 (Go): upgrade to 3.10.0 or later
```
go get github.com/projectdiscovery/nuclei/v3@v3.10.0
```

Technical details

The vulnerability exists in Nuclei's JavaScript MySQL client library used by `javascript:` protocol templates. The MySQL connection logic fails to enforce the `-allow-local-file-access` sandbox restriction when the `allowAllFiles` DSN parameter is set to true, allowing `LOAD DATA LOCAL INFILE` commands to read arbitrary files. The attack requires a malicious or compromised MySQL server and the ability to execute unsigned or untrusted JavaScript templates, which run by default without the `-code` flag. An attacker can exfiltrate sensitive files to the MySQL server, bypassing file access controls that would normally restrict reads to the templates directory. The issue is patched in Nuclei v3.10.0 by stripping the `allowAllFiles` option unless `-lfa` is explicitly enabled.

Affected products

ProjectDiscovery Nuclei before 3.10.0

Identifiers

CVE-2026-76803
GHSA-xhmx-w2j4-rw3q
GO-2026-6577

Timeline

2026-09-22: disclosed
2026: patched: Fixed in Nuclei v3.10.0 per PR #7473

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.