{"id":"CVE-2026-76805","kind":"vulnerability","aliases":["CVE-2026-76805","GHSA-jpvm-9frm-hjcq","GO-2026-6571"],"related":[],"title":"Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode in github.com/projectdiscovery/nuclei","description":"Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor in one protocol step to be reinterpreted as template syntax in a later fuzz step. This vulnerability is an incomplete fix for CVE-2026-41645: the prior remediation made expressions.Evaluate() single-pass within one call but did not prevent DAST/fuzz callers from evaluating substituted output again. When -env-vars is enabled, a malicious scan target can return marker-shaped content that resolves against the template variable map and discloses scanner-host environment variables such as credentials, API keys, or tokens. The vulnerability requires a multi-step DAST or fuzz template, response data reused through an internal extractor, and explicit environment-variable expansion; users who do not enable -env-vars are not affected by the sensitive-information disclosure. This issue is fixed in version 3.10.0.","summary":"Nuclei's DAST/fuzz path can evaluate response data a second time as template syntax, so a malicious scan target can make the scanner resolve host environment variables. An attacker who controls a scan target can read scanner-host secrets such as credentials, API keys, or tokens.","severity":"medium","cvss":5.3,"epss":0.0041,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/projectdiscovery/nuclei","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/projectdiscovery/nuclei/v2","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/projectdiscovery/nuclei/v3","fixed":["3.10.0"],"affected":">= 3.0.0, < 3.10.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["ci","go","nuclei","package","scanner-operators"],"not_affected_if":["default-config","no-env-vars-flag","single-step-templates","version-3.10.0-or-later"],"how_to_check":"Check the go.mod of each project that uses Nuclei for github.com/projectdiscovery/nuclei/v3 below 3.10.0.\nSearch scan scripts and CI configs for the -env-vars flag combined with multi-step DAST or fuzz templates.","fix":"Upgrade github.com/projectdiscovery/nuclei/v3 to 3.10.0 or later.\nUntil upgraded, do not run -env-vars against untrusted targets.","status":"open","published_at":"2026-09-22T17:17:25+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:48:57+00:00","updated_at":"2026-10-23T21:48:57+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:48:57Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/projectdiscovery/nuclei/v3 to 3.10.0 or later.\nUntil upgraded, do not run -env-vars against untrusted targets.","reach":"internet","impact":"medium","summary":"Nuclei's DAST/fuzz path can evaluate response data a second time as template syntax, so a malicious scan target can make the scanner resolve host environment variables. An attacker who controls a scan target can read scanner-host secrets such as credentials, API keys, or tokens.","category":"package","who_cares":["nuclei","go","scanner-operators","ci"],"confidence":0.8,"needs_auth":"no","worst_case":"Scanner-host environment variables such as API keys and tokens are readable by the target.","analyst_note":"Govuln lists no fixed version for the github.com/projectdiscovery/nuclei and nuclei/v2 paths; confirm at https://github.com/advisories/GHSA-jpvm-9frm-hjcq.","how_to_check":"Check the go.mod of each project that uses Nuclei for github.com/projectdiscovery/nuclei/v3 below 3.10.0.\nSearch scan scripts and CI configs for the -env-vars flag combined with multi-step DAST or fuzz templates.","needs_analyst":true,"not_affected_if":["default-config","no-env-vars-flag","single-step-templates","version-3.10.0-or-later"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.001055,"input_tokens":3291,"output_tokens":1451,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':18A,26A,29A,163C '-41645':164C '-6571':27A '-76805':19A,30A '/projectdiscovery/nuclei':16A,33A '/projectdiscovery/nuclei/v2':36A '/projectdiscovery/nuclei/v3':39A '3.0.0':108C '3.10.0':110C,271C '9frm':23A 'affect':258C 'allow':131C 'api':90B,220C 'attack':75B 'base':105C 'built':99C 'call':175C 'caller':181C 'captur':134C 'ci':40B 'content':133C,202C 'control':77B 'creat':125C 'credenti':89B,219C 'cve':17A,28A,162C 'dast':231C 'dast/fuzz':11A,49B,112C,180C 'data':9A,54B,121C,236C 'deriv':8A 'disclos':211C 'disclosur':4A,264C 'dsl':106C 'enabl':192C,252C 'env':189C,254C 'env-var':188C,253C 'environ':2A,72B,215C,245C 'environment-vari':244C 'evalu':52B,118C,128C,183C 'expans':247C 'explicit':243C 'expressions.evaluate':169C 'extractor':139C,241C 'fix':160C,268C 'fuzz':153C,233C 'ghsa':21A 'ghsa-jpvm-9frm-hjcq':20A 'github.com':15A,32A,35A,38A 'github.com/projectdiscovery/nuclei':14A,31A 'github.com/projectdiscovery/nuclei/v2':34A 'github.com/projectdiscovery/nuclei/v3':37A 'go':25A,41B 'hjcq':24A 'host':71B,85B,214C 'incomplet':159C 'inform':263C 'intern':137C,240C 'issu':266C 'jpvm':22A 'key':91B,221C 'later':152C 'made':168C 'make':67B 'malici':63B,194C 'map':209C 'marker':200C 'marker-shap':199C 'mode':12A 'multi':229C 'multi-step':228C 'nuclei':1A,42B,47B,94C 'one':141C,174C 'oper':46B 'output':185C 'packag':43B 'pass':129C,172C 'path':50B,114C 'payload':113C 'pkg/fuzz/parts.go':116C 'prevent':179C 'prior':166C 'protocol':142C 'read':82B 'reinterpret':146C 'remedi':167C 'requir':226C 'resolv':70B,204C 'respons':7A,53B,132C,235C 'response-deriv':6A 'return':198C 'reus':237C 'runtim':120C 'scan':64B,79B,195C 'scanner':45B,69B,84B,98C,213C 'scanner-host':83B,212C 'scanner-oper':44B 'second':56B,127C 'secret':86B 'sensit':262C 'sensitive-inform':261C 'shape':201C 'simpl':102C 'singl':171C 'single-pass':170C 'step':143C,154C,230C 'substitut':119C,184C 'syntax':60B,149C 'target':65B,80B,196C 'templat':59B,148C,207C,234C 'time':57B 'token':93B,223C 'true':138C 'user':248C 'var':190C,255C 'variabl':3A,73B,208C,216C,246C 'version':270C 'via':5A 'vulner':97C,156C,225C 'within':173C 'yaml':104C 'yaml-bas':103C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-22T17:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6571","url":"https://pkg.go.dev/vuln/GO-2026-6571","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-01T20:23:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76805","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76805","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-76805","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76805","severity":null,"published_at":"2026-09-22T17:17:25+00:00","modified_at":"2026-09-23T18:28:25+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}