Executive brief
Nuclei is a vulnerability scanner that uses digitally signed templates to ensure the authenticity of security checks. Versions before 3.11.1 cache template verification status based only on file modification time without verifying the template content itself. An attacker can replace a verified template with malicious code and restore the original modification time to bypass security checks, allowing arbitrary command execution on systems running the scanner.
Technical details
The vulnerability exists in Nuclei's template caching logic, which validates cached template signatures using only the file modification time (ModTime) without comparing content checksums. The IsValid() method in the metadata cache compares stored ModTime against the current file modification time; if they match, the cached verification status is trusted without re-validating template content. An attacker with filesystem access can replace a verified template file with unsigned malicious content and restore the original modification time to defeat this check. This allows execution of arbitrary operating system commands through the malicious template. The fix was implemented in version 3.11.1.
Affected products
- Projectdiscovery Nuclei before 3.11.1
Timeline
- 2026-09-16: disclosed