{"id":"CVE-2026-76819","kind":"vulnerability","aliases":["CVE-2026-76819","GHSA-vxg7-f2jj-jmqm","GO-2026-6575"],"related":[],"title":"Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability in github.com/projectdiscovery/nuclei","description":"Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability in github.com/projectdiscovery/nuclei","summary":"Nuclei, a Go vulnerability scanner from ProjectDiscovery, has a flaw in its use of the Goja JavaScript engine that the sources describe as arbitrary code execution. The entry is marked withdrawn, and the sources give no attack details.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/projectdiscovery/nuclei","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/projectdiscovery/nuclei/v2","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/projectdiscovery/nuclei/v3","fixed":["3.10.0"],"affected":">= 3.0.0, < 3.10.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","nuclei","package","security-scanning"],"not_affected_if":["withdrawn-entry"],"how_to_check":"Run nuclei -version and compare against the affected range (github.com/projectdiscovery/nuclei/v3 >= 3.0.0, < 3.10.0).","fix":"Upgrade github.com/projectdiscovery/nuclei/v3 to 3.10.0 or later, if the advisory is still live.","status":"withdrawn","published_at":"2026-09-22T17:17:25+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:49:25+00:00","updated_at":"2026-10-23T21:49:25+00:00","category":"package","confidence":0.35,"triage":{"at":"2026-10-23T21:49:25Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/projectdiscovery/nuclei/v3 to 3.10.0 or later, if the advisory is still live.\nunknown","reach":"unknown","impact":"high","summary":"Nuclei, a Go vulnerability scanner from ProjectDiscovery, has a flaw in its use of the Goja JavaScript engine that the sources describe as arbitrary code execution. The entry is marked withdrawn, and the sources give no attack details.","category":"package","who_cares":["go","nuclei","security-scanning"],"confidence":0.35,"needs_auth":"unknown","worst_case":"Arbitrary code execution is claimed, but the sources give no details.","analyst_note":"Entry is withdrawn with no detail; check https://pkg.go.dev/vuln/GO-2026-6575 and the NVD record to confirm whether the withdrawal stands and what the Goja issue was.","how_to_check":"Run nuclei -version and compare against the affected range (github.com/projectdiscovery/nuclei/v3 >= 3.0.0, < 3.10.0).\nunknown\nunknown","needs_analyst":true,"not_affected_if":["withdrawn-entry"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00052,"input_tokens":2922,"output_tokens":455,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,23A,26A '-6575':24A '-76819':16A,27A '/projectdiscovery/nuclei':13A,30A,93C '/projectdiscovery/nuclei/v2':33A '/projectdiscovery/nuclei/v3':36A 'arbitrari':2A,66B,82C 'attack':79B 'code':3A,67B,83C 'cve':14A,25A 'describ':64B 'detail':80B 'engin':8A,60B,88C 'entri':70B 'execut':4A,68B,84C 'f2jj':20A 'flaw':52B 'ghsa':18A 'ghsa-vxg7-f2jj-jmqm':17A 'github.com':12A,29A,32A,35A,92C 'github.com/projectdiscovery/nuclei':11A,28A,91C 'github.com/projectdiscovery/nuclei/v2':31A 'github.com/projectdiscovery/nuclei/v3':34A 'give':77B 'go':22A,37B,45B 'goja':6A,58B,86C 'javascript':7A,59B,87C 'jmqm':21A 'mark':72B 'nuclei':1A,38B,43B,81C 'packag':39B 'projectdiscoveri':49B 'scan':42B 'scanner':47B 'secur':41B 'security-scan':40B 'sourc':63B,76B 'use':55B 'via':5A,85C 'vulner':9A,46B,89C 'vxg7':19A 'withdrawn':73B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-22T17:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6575","url":"https://pkg.go.dev/vuln/GO-2026-6575","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-01T20:23:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-76819","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76819","severity":null,"published_at":"2026-09-22T17:17:25+00:00","modified_at":"2026-09-22T17:17:25+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}