{"id":"CVE-2026-76802","kind":"vulnerability","aliases":["CVE-2026-76802","GHSA-jpf4-98qj-qr67","GO-2026-6570"],"related":[],"title":"Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass in github.com/projectdiscovery/nuclei","description":"Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template signature check before accepting a template that contains both a fuzzing: block and an unsigned code: block. When an operator enables -dast, an untrusted multiprotocol template can place an unsigned code request into the execution queue and run arbitrary shell commands even without -code or a valid cryptographic signature. The issue affects CLI DAST scans and SDK integrations that enable DAST while accepting attacker-supplied templates. This issue is fixed in version 3.10.0.","summary":"Nuclei, a Go vulnerability scanner, skips its unsigned code-template signature check when DAST is enabled and loads a template that contains a fuzzing block with an unsigned code block. An attacker who can supply a template can run arbitrary shell commands on the host running the scan.","severity":"medium","cvss":4.7,"epss":0.00181,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/projectdiscovery/nuclei","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/projectdiscovery/nuclei/v2","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/projectdiscovery/nuclei/v3","fixed":["3.10.0"],"affected":">= 3.0.0, < 3.10.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["ci-pipelines","go","nuclei","package","sdk-integrators","security-scanning"],"not_affected_if":["dast-disabled","default-config","only-trusted-templates","version-3.10.0-or-later"],"how_to_check":"Check go.mod for github.com/projectdiscovery/nuclei/v3 with a version from 3.0.0 up to but not including 3.10.0. Check whether scans run with -dast and accept templates from untrusted sources.","fix":"Upgrade github.com/projectdiscovery/nuclei/v3 to 3.10.0 or later. Fixed versions for the unversioned and v2 module paths are unknown.","status":"open","published_at":"2026-09-22T17:17:24+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:49:10+00:00","updated_at":"2026-10-23T21:49:10+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:49:10Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/projectdiscovery/nuclei/v3 to 3.10.0 or later. Fixed versions for the unversioned and v2 module paths are unknown.","reach":"unknown","impact":"high","summary":"Nuclei, a Go vulnerability scanner, skips its unsigned code-template signature check when DAST is enabled and loads a template that contains a fuzzing block with an unsigned code block. An attacker who can supply a template can run arbitrary shell commands on the host running the scan.","category":"package","who_cares":["nuclei","go","security-scanning","ci-pipelines","sdk-integrators"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Arbitrary shell commands run on the machine running the scan","analyst_note":"","how_to_check":"Check go.mod for github.com/projectdiscovery/nuclei/v3 with a version from 3.0.0 up to but not including 3.10.0. Check whether scans run with -dast and accept templates from untrusted sources.","needs_analyst":false,"not_affected_if":["default-config","dast-disabled","only-trusted-templates","version-3.10.0-or-later"],"user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.001,"input_tokens":3124,"output_tokens":1375,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,23A,26A '-6570':24A '-76802':16A,27A '/projectdiscovery/nuclei':13A,30A '/projectdiscovery/nuclei/v2':33A '/projectdiscovery/nuclei/v3':36A '3.0.0':112C '3.10.0':114C,201C '98qj':20A 'accept':131C,190C 'affect':179C 'appli':122C 'arbitrari':2A,89B,166C 'attack':81B,192C 'attacker-suppli':191C 'base':109C 'block':74B,79B,139C,144C 'branch':119C 'built':103C 'bypass':9A 'check':61B,129C 'ci':38B 'ci-pipelin':37B 'cli':180C 'code':7A,58B,78B,126C,143C,158C,171C 'code-templ':57B,125C 'command':3A,91B,168C 'contain':71B,135C 'cryptograph':175C 'cve':14A,25A 'dast':6A,63B,116C,149C,181C,188C 'dsl':110C 'enabl':65B,148C,187C 'even':169C 'execut':4A,162C 'fix':198C 'fuzz':73B,138C 'ghsa':18A 'ghsa-jpf4-98qj-qr67':17A 'github.com':12A,29A,32A,35A 'github.com/projectdiscovery/nuclei':11A,28A 'github.com/projectdiscovery/nuclei/v2':31A 'github.com/projectdiscovery/nuclei/v3':34A 'go':22A,40B,51B 'host':94B 'integr':45B,185C 'issu':178C,196C 'jpf4':19A 'load':67B,118C 'multiprotocol':152C 'nuclei':1A,41B,49B,98C 'oper':147C 'packag':42B 'pipelin':39B 'place':155C 'qr67':21A 'queue':163C 'request':159C 'run':88B,95B,165C 'scan':48B,97B,182C 'scanner':53B,102C 'sdk':44B,184C 'sdk-integr':43B 'secur':47B 'security-scan':46B 'shell':90B,167C 'signatur':8A,60B,128C,176C 'simpl':106C 'skip':54B 'suppli':84B,193C 'templat':59B,69B,86B,117C,127C,133C,153C,194C 'unsign':56B,77B,124C,142C,157C 'untrust':151C 'valid':174C 'version':200C 'via':5A 'vulner':52B,101C 'without':170C 'yaml':108C 'yaml-bas':107C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-22T17:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6570","url":"https://pkg.go.dev/vuln/GO-2026-6570","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-01T20:23:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76802","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76802","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-76802","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76802","severity":null,"published_at":"2026-09-22T17:17:24+00:00","modified_at":"2026-09-24T21:20:08+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}