CVE-2026-41645

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's expression evaluation engine makes it possible for a malicious target server to inject and execute supported DSL expressions. This happens when HTTP response data containing helper/function syntax gets reused by multi-step templates. If the -env-vars / -ev option is explicitly enabled, this can expose host environment variables. That option is off by default, so standard configurations are not affected by the information disclosure risk. This issue has been patched in version 3.8.0.

• CWE-94

• https://github.com/projectdiscovery/nuclei/commit/6c803c74d193f85f8a6d9803ce493fd302cad0ebPatch
• https://github.com/projectdiscovery/nuclei/commit/d2217320162d5782ca7cb95bef9dda17063818f3Patch
• https://github.com/projectdiscovery/nuclei/pull/7221Issue Tracking, Patch
• https://github.com/projectdiscovery/nuclei/pull/7321Issue Tracking, Patch
• https://github.com/projectdiscovery/nuclei/releases/tag/v3.8.0Product, Release Notes
• https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jm34-66cf-qpvrMitigation, Patch, Vendor Advisory

Published

May 8, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4164A flaw has been found in Wavlink WL-WN578W2 221110. Impacted…9.8
• CVE-2026-41640NocoBase is an AI-powered no-code/low-code platform for buil…8.8
• CVE-2026-41641NocoBase is an AI-powered no-code/low-code platform for buil…7.2
• CVE-2026-41642GoBGP is an open source Border Gateway Protocol (BGP) implem…7.5
• CVE-2026-41643GoBGP is an open source Border Gateway Protocol (BGP) implem…7.5
• CVE-2026-41644monetr is a budgeting application for recurring expenses. Pr…7.1
• CVE-2026-41646Nuclei is a vulnerability scanner built on a simple YAML-bas…5.5
• CVE-2026-41647Incus is a system container and virtual machine manager. Pri…6.5
• CVE-2026-41648Incus is a system container and virtual machine manager. Pri…5
• CVE-2026-41649Outline is a service that allows for collaborative documenta…7.7
• CVE-2026-4165A vulnerability has been found in Worksuite HR, CRM and Proj…2.4
• CVE-2026-41650fast-xml-parser allows users to process XML from JS object w…6.1