CVE-2026-41646

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41646
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41646.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41646
Aliases
Published
2026-05-08T03:14:49.908Z
Modified
2026-07-08T08:13:13.089088695Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Nuclei: Local File Read via require() Module Loader Bypass
Details

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require() function, bypassing the default local file access restriction. This issue has been patched in version 3.8.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41646.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-284"
    ]
}
References

Affected packages

Git / github.com/projectdiscovery/nuclei

Affected ranges

Type
GIT
Repo
https://github.com/projectdiscovery/nuclei
Events
Introduced
990cec0de154bd3955e0c1e19951f90e06f6ea7c
Fixed
aa52d85991c0a9c14d044de26857d6c2959fb15d
Fixed
6f2ade6a9b427c284c15a43445f9c7f055e60e5d
Database specific 
{
    "cpe": "cpe:2.3:a:projectdiscovery:nuclei:*:*:*:*:*:go:*:*",
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.8.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.1.0
v3.1.1
v3.1.10
v3.1.2
v3.1.3
v3.1.4
v3.1.5
v3.1.6
v3.1.7
v3.1.8
v3.1.9
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.2.4
v3.2.5
v3.2.6
v3.2.7
v3.2.8
v3.2.9
v3.3.0
v3.3.1
v3.3.10
v3.3.2
v3.3.3
v3.3.4
v3.3.5
v3.3.6
v3.3.7
v3.3.8
v3.3.9
v3.4.0
v3.4.1
v3.4.10
v3.4.2
v3.4.3
v3.4.4
v3.4.5
v3.4.6
v3.4.7
v3.4.8
v3.4.9
v3.5.0
v3.5.1
v3.6.0
v3.6.1
v3.6.2
v3.7.0
v3.7.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41646.json"