Vulnerability-Lookup

GHSA-JPVM-9FRM-HJCQ

Vulnerability from github – Published: 2026-09-22 20:37 – Updated: 2026-09-22 20:37

Summary

Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode

Details

A vulnerability in Nuclei's DAST/fuzz expression evaluation path allows a malicious target server to trigger disclosure of scanner-host environment variables when the -env-vars / -ev option is explicitly enabled.

This is an incomplete fix for CVE-2026-41645 / GHSA-jm34-66cf-qpvr. The original fix hardened expressions.Evaluate() to be single-pass within one call, but did not address callers that invoked evaluation multiple times on substituted output in the DAST/fuzz pipeline.

Affected Component

The issue is in the DAST/fuzz payload evaluation path (pkg/fuzz/parts.go) and the shared template rendering boundary. When a multi-step template captures response data via an internal extractor and reuses it in a subsequent fuzz step, the fuzz evaluator could treat the substituted response content as fresh template syntax on a second evaluation pass.

Description

In DAST/fuzz mode, payload evaluation previously ran expression substitution more than once on the same value. Response-derived content captured by an internal: true extractor in a prior protocol step could flow into a fuzz payload and be reinterpreted as DSL/helper syntax on a subsequent pass.

When -env-vars (-ev) is enabled, environment variables are merged into the template variable map. A malicious target can return response data containing expressions like {{env_var_name}} which, when reused in a subsequent fuzz step, resolve to actual environment variable values. This can expose sensitive host data such as API keys, credentials, and tokens.

Without -ev enabled (the default), response-derived data may still cause other DSL helpers to run, but that behavior is not treated as a security issue and has no meaningful security impact beyond unexpected behavior.

[!NOTE] The -env-vars / -ev option is off by default. Users who have not explicitly enabled it are not affected by this vulnerability.

Affected Users

CLI users running nuclei -dast (or fuzzing) with multi-step templates that chain an internal extractor into a subsequent fuzz step against untrusted targets, with the -ev flag enabled.
SDK users who integrate Nuclei with the fuzz pipeline enabled, EnvironmentVariables set to true, and scan targets that are not fully trusted.

Patches

The vulnerability is fixed in Nuclei v3.10.0. Upgrading is strongly recommended.
Fix reference: https://github.com/projectdiscovery/nuclei/pull/7499
Related original fix: https://github.com/projectdiscovery/nuclei/pull/7221, https://github.com/projectdiscovery/nuclei/pull/7321

Mitigation

Upgrade to Nuclei v3.10.0, where template-authored text is rendered once through a shared rendering boundary and runtime values from responses, extractors, and constants remain opaque data.

If you have -ev enabled, disable it when scanning untrusted targets to avoid environment variable disclosure.

Workarounds

If upgrading is not an option, ensure -env-vars / -ev is not enabled when running DAST/fuzz scans with multi-step templates against untrusted targets.

Acknowledgments

Thanks to @BerSecHub for reporting this issue.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/projectdiscovery/nuclei/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.10.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-76805"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T20:37:24Z",
    "nvd_published_at": "2026-09-22T17:17:25Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in Nuclei\u0027s DAST/fuzz expression evaluation path allows a malicious target server to trigger disclosure of scanner-host environment variables when the `-env-vars` / `-ev` option is explicitly enabled.\n\nThis is an incomplete fix for [CVE-2026-41645](https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jm34-66cf-qpvr) / GHSA-jm34-66cf-qpvr. The original fix hardened `expressions.Evaluate()` to be single-pass within one call, but did not address callers that invoked evaluation multiple times on substituted output in the DAST/fuzz pipeline.\n\n**Affected Component**\n\nThe issue is in the DAST/fuzz payload evaluation path (`pkg/fuzz/parts.go`) and the shared template rendering boundary. When a multi-step template captures response data via an internal extractor and reuses it in a subsequent fuzz step, the fuzz evaluator could treat the substituted response content as fresh template syntax on a second evaluation pass.\n\n**Description**\n\nIn DAST/fuzz mode, payload evaluation previously ran expression substitution more than once on the same value. Response-derived content captured by an `internal: true` extractor in a prior protocol step could flow into a fuzz payload and be reinterpreted as DSL/helper syntax on a subsequent pass.\n\nWhen `-env-vars` (`-ev`) is enabled, environment variables are merged into the template variable map. A malicious target can return response data containing expressions like `{{env_var_name}}` which, when reused in a subsequent fuzz step, resolve to actual environment variable values. This can expose sensitive host data such as API keys, credentials, and tokens.\n\nWithout `-ev` enabled (the default), response-derived data may still cause other DSL helpers to run, but that behavior is not treated as a security issue and has no meaningful security impact beyond unexpected behavior.\n\n\u003e [!NOTE]\nThe `-env-vars` / `-ev` option is off by default. Users who have not explicitly enabled it are not affected by this vulnerability.\n\n**Affected Users**\n\n- **CLI users** running `nuclei -dast` (or fuzzing) with multi-step templates that chain an internal extractor into a subsequent fuzz step against untrusted targets, with the `-ev` flag enabled.\n- **SDK users** who integrate Nuclei with the fuzz pipeline enabled, `EnvironmentVariables` set to `true`, and scan targets that are not fully trusted.\n\n**Patches**\n\n- The vulnerability is fixed in Nuclei v3.10.0. Upgrading is strongly recommended.\n- Fix reference: https://github.com/projectdiscovery/nuclei/pull/7499\n- Related original fix: https://github.com/projectdiscovery/nuclei/pull/7221, https://github.com/projectdiscovery/nuclei/pull/7321\n\n**Mitigation**\n\nUpgrade to Nuclei v3.10.0, where template-authored text is rendered once through a shared rendering boundary and runtime values from responses, extractors, and constants remain opaque data.\n\nIf you have `-ev` enabled, disable it when scanning untrusted targets to avoid environment variable disclosure.\n\n**Workarounds**\n\nIf upgrading is not an option, ensure `-env-vars` / `-ev` is not enabled when running DAST/fuzz scans with multi-step templates against untrusted targets.\n\n**Acknowledgments**\n\nThanks to @BerSecHub for reporting this issue.",
  "id": "GHSA-jpvm-9frm-hjcq",
  "modified": "2026-09-22T20:37:24Z",
  "published": "2026-09-22T20:37:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jpvm-9frm-hjcq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76805"
    },
    {
      "type": "WEB",
      "url": "https://github.com/projectdiscovery/nuclei/pull/7499"
    },
    {
      "type": "WEB",
      "url": "https://github.com/projectdiscovery/nuclei/commit/ccbfb12bd01447ba25f6e755dfb2bee677736da6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/projectdiscovery/nuclei"
    },
    {
      "type": "WEB",
      "url": "https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode"
}

CVE-2026-76805 (GCVE-0-2026-76805)

Vulnerability from cvelistv5 – Published: 2026-09-22 16:48 – Updated: 2026-09-22 18:19

Title

Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode

Summary

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor in one protocol step to be reinterpreted as template syntax in a later fuzz step. This vulnerability is an incomplete fix for CVE-2026-41645: the prior remediation made expressions.Evaluate() single-pass within one call but did not prevent DAST/fuzz callers from evaluating substituted output again. When -env-vars is enabled, a malicious scan target can return marker-shaped content that resolves against the template variable map and discloses scanner-host environment variables such as credentials, API keys, or tokens. The vulnerability requires a multi-step DAST or fuzz template, response data reused through an internal extractor, and explicit environment-variable expansion; users who do not enable -env-vars are not affected by the sensitive-information disclosure. This issue is fixed in version 3.10.0.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 18:19 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/projectdiscovery/nuclei/securi…	x_refsource_CONFIRM
https://github.com/projectdiscovery/nuclei/pull/7499	x_refsource_MISC
https://github.com/projectdiscovery/nuclei/commit…	x_refsource_MISC
https://github.com/projectdiscovery/nuclei/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
projectdiscovery	nuclei	Affected: >= 3.0.0, < 3.10.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76805",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T18:19:01.898488Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T18:19:16.720Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuclei",
          "vendor": "projectdiscovery",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.10.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor in one protocol step to be reinterpreted as template syntax in a later fuzz step. This vulnerability is an incomplete fix for CVE-2026-41645: the prior remediation made expressions.Evaluate() single-pass within one call but did not prevent DAST/fuzz callers from evaluating substituted output again. When -env-vars is enabled, a malicious scan target can return marker-shaped content that resolves against the template variable map and discloses scanner-host environment variables such as credentials, API keys, or tokens. The vulnerability requires a multi-step DAST or fuzz template, response data reused through an internal extractor, and explicit environment-variable expansion; users who do not enable -env-vars are not affected by the sensitive-information disclosure. This issue is fixed in version 3.10.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T16:48:49.791Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jpvm-9frm-hjcq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jpvm-9frm-hjcq"
        },
        {
          "name": "https://github.com/projectdiscovery/nuclei/pull/7499",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/projectdiscovery/nuclei/pull/7499"
        },
        {
          "name": "https://github.com/projectdiscovery/nuclei/commit/ccbfb12bd01447ba25f6e755dfb2bee677736da6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/projectdiscovery/nuclei/commit/ccbfb12bd01447ba25f6e755dfb2bee677736da6"
        },
        {
          "name": "https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0"
        }
      ],
      "source": {
        "advisory": "GHSA-jpvm-9frm-hjcq",
        "discovery": "UNKNOWN"
      },
      "title": "Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76805",
    "datePublished": "2026-09-22T16:48:49.791Z",
    "dateReserved": "2026-08-19T19:52:28.212Z",
    "dateUpdated": "2026-09-22T18:19:16.720Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-JPVM-9FRM-HJCQ

CVE-2026-76805 (GCVE-0-2026-76805)

Tags

Sightings

Nomenclature

Related by attack behaviour