Executive brief
Nuclei is a vulnerability scanner that uses templates to test systems for security issues. A flaw in its JavaScript MySQL client library allows untrusted templates to read arbitrary files on the scanner host by connecting to a malicious MySQL server, bypassing Nuclei's built-in filesystem access restrictions. This affects users running third-party templates against database targets.
Technical details
The vulnerability exists in Nuclei's JavaScript MySQL client library used by `javascript:` protocol templates. The MySQL connection logic fails to enforce the `-allow-local-file-access` sandbox restriction when the `allowAllFiles` DSN parameter is set to true, allowing `LOAD DATA LOCAL INFILE` commands to read arbitrary files. The attack requires a malicious or compromised MySQL server and the ability to execute unsigned or untrusted JavaScript templates, which run by default without the `-code` flag. An attacker can exfiltrate sensitive files to the MySQL server, bypassing file access controls that would normally restrict reads to the templates directory. The issue is patched in Nuclei v3.10.0 by stripping the `allowAllFiles` option unless `-lfa` is explicitly enabled.
Affected products
- ProjectDiscovery Nuclei before 3.10.0
Timeline
- 2026-09-22: disclosed
- 2026: patched: Fixed in Nuclei v3.10.0 per PR #7473