CVE-2026-76805

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor in one protocol step to be reinterpreted as template syntax in a later fuzz step. This vulnerability is an incomplete fix for CVE-2026-41645: the prior remediation made expressions.Evaluate() single-pass within one call but did not prevent DAST/fuzz callers from evaluating substituted output again. When -env-vars is enabled, a malicious scan target can return marker-shaped content that resolves against the template variable map and discloses scanner-host environment variables such as credentials, API keys, or tokens. The vulnerability requires a multi-step DAST or fuzz template, response data reused through an internal extractor, and explicit environment-variable expansion; users who do not enable -env-vars are not affected by the sensitive-information disclosure. This issue is fixed in version 3.10.0.

• CWE-200

• https://github.com/projectdiscovery/nuclei/commit/ccbfb12bd01447ba25f6e755dfb2bee677736da6
• https://github.com/projectdiscovery/nuclei/pull/7499
• https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0
• https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jpvm-9frm-hjcq

Published

Sep 22, 2026

Last Modified

Sep 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7680A weakness has been identified in jsbroks COCO Annotator up …4.3
• CVE-2026-76800A flaw has been found in DeDeCMS 3. Affected by this vulnera…6.3
• CVE-2026-76801The FireBox – WooCommerce Popup Builder, Exit Intent Popup, …8.8
• CVE-2026-76802Nuclei is a vulnerability scanner built on a simple YAML-bas…4.7
• CVE-2026-76803Nuclei is a vulnerability scanner built on a simple YAML-bas…5.3
• CVE-2026-76804Nuclei is a vulnerability scanner built on a simple YAML-bas…5.5
• CVE-2026-7681A security vulnerability has been detected in jsbroks COCO A…6.5
• CVE-2026-76816Netty is an asynchronous, event-driven network application f…3.5
• CVE-2026-76819Rejected reason: Further research determined the issue resul…
• CVE-2026-7682A security flaw has been discovered in Edimax BR-6208AC 1.02…6.3
• CVE-2026-76820OpenCTI is an open source platform for managing cyber threat…7.7
• CVE-2026-76821OpenCTI is an open source platform for managing cyber threat…7.1