11 KiB
Security Context: projectdiscovery/nuclei @ dev
Reference context for editing projectdiscovery/nuclei. Before changing any component below, preserve the listed guards and do not reintroduce these fixed issues. Each fingerprint is a regression check, and each shared attack surface is a guard that must keep holding on every path.
Analyzed df57ae6d29 on dev · 5174 commits, 548 security-relevant examined · generated 2026-11-02
Recurring Security Patterns
7.1% of classified fixes repeat a previously fixed pattern (1 recurring, 13 first-seen). A recurring pattern means this repository fixed a similar issue before — not that the code is currently vulnerable.
Top Risks
Components with the strongest concentration of past fixes for one class.
| # | Class | Component | Severity | Fixes | Evidence |
|---|---|---|---|---|---|
| 1 | SSRF | pkg/protocols/common/protocolstate/headless.go |
high | 2 | d43c1f547f, d9dabbb4a1 |
| 2 | Arbitrary File Access | v2/pkg/protocols/common/generators/load.go |
high | 0 (1 component gone, not counted) | e5154d362a |
| 3 | Arbitrary File Access | pkg/js/libs/mysql/mysql.go |
high | 1 | 634cecbb28 |
| 4 | Code Execution | pkg/fuzz/execute.go |
high | 1 | ccbfb12bd0 |
| 5 | Code Execution | pkg/protocols/common/expressions/expressions.go |
high | 1 | d221732016 |
| 6 | Information Disclosure | internal/httpapi/apiendpoint.go |
high | 1 | a20aa26024 |
Fixed-Issue Fingerprints
Real security fixes mined from git history; use them as regression checks. verified fixes are linked to a published advisory, inferred fixes were confirmed from the diff evidence alone. Each is identified by its short commit SHA, which the variant-leads report uses to reference it back to this history.
By component (directories with the most fixes):
-
pkg/protocols/common/protocolstate— 2 fixes: SSRF (2) -
1c0f77d28e fix(js/net): enforce network policy on proxied target in JS net dial — SSRF, high [CWE-918] · inferred · 2026-10-18
pkg/js/libs/net/net.go· sinkdialHTTPProxy· fix: input validation -
d43c1f547f fix(headless): canonicalize IPv4-mapped IPv6 literals and re-validate dial targets — SSRF, high [CWE-918] · inferred · 2026-10-13
pkg/protocols/common/protocolstate/headless.go· sinknet.DialTimeout· fix: canonicalization before validation -
d9dabbb4a1 fix(headless): enforce network policy on ws and wss schemes (#7867) — SSRF, high [CWE-918] · inferred · 2026-10-12
pkg/protocols/common/protocolstate/headless.go· sinkisValidHost· fix: canonicalization before validation -
a20aa26024 Fix pprof/auth exposure on http-api-endpoint and harden file permissions — Information Disclosure, high [CWE-200] · inferred · 2026-08-03
internal/httpapi/apiendpoint.go· sinkhttp.ListenAndServe· fix: authentication verification -
fac0b7196d feat(templates): require signatures for javascript templates (#7514) — Signature Verification Bypass, high [CWE-347] · verified (CVE-2026-76819, GHSA-vxg7-f2jj-jmqm) · 2026-07-03
pkg/catalog/loader/loader.go· sinkt.HasJavascriptRequest· fix: cryptographic verification -
ccbfb12bd0 refactor(protocols): template rendering boundary (#7499) — Code Execution, high [CWE-94] · verified (CVE-2026-76805, GHSA-jpvm-9frm-hjcq) · 2026-06-30
pkg/fuzz/execute.go· sinkexpressions.Evaluate· fix: sandbox isolation -
3a8b65cb45 fix(js): reject unsandboxed ccache writes in krbforge (#7482) — Sandbox Escape, high [CWE-693] · inferred · 2026-06-24
pkg/js/libs/krbforge/krbforge.go· sinkOutputFile· fix: sandbox isolation -
68daef44a7 fix(js): escape dbname in lib/pq URL (#7479) — SQL Injection, high [CWE-89] · inferred · 2026-06-23
pkg/js/libs/postgres/postgres.go· sinkfmt.Sprintf(library call — the operation around it is the sink) · fix: context-aware output escaping -
634cecbb28 gate mysql allowAllFiles behind -lfa — Arbitrary File Access, high [CWE-22] · verified (CVE-2026-76803, GHSA-xhmx-w2j4-rw3q) · 2026-06-19
pkg/js/libs/mysql/mysql.go· sinksql.Open· fix: sandbox isolation -
20cbf0bd73 refactor: use path-aware filesystem containment checks (#7420) — Path Traversal, high [CWE-22] · inferred · 2026-06-04
pkg/installer/template.go· sinkfilepath.Join· fix: canonicalization before validation -
6f2ade6a9b fix(js): respect `allow-local-file-access` in `require` (#7332) — Sandbox Escape, high [CWE-693] · inferred · 2026-04-10
pkg/js/compiler/pool.go· sinkrequire.DefaultSourceLoader· fix: sandbox isolation -
d221732016 fix(expressions): only eval template-authored expressions (#7221) — Code Execution, high [CWE-94] · verified (CVE-2026-76805, GHSA-jpvm-9frm-hjcq) · 2026-03-16
pkg/protocols/common/expressions/expressions.go· sinkFindExpressions· fix: allowlist enforcement -
0da993afe6 Merge commit from fork — Signature Verification Bypass, medium [CWE-347] · verified (CVE-2024-43405, GHSA-7h5p-mmpp-hgmm) · 2024-08-19
pkg/templates/signer/tmpl_signer.go· sinkos.ReadFile· fix: cryptographic verification -
e5154d362a fixing payload load (#3927) — Arbitrary File Access, high [CWE-22] · verified (CVE-2023-37896, GHSA-2xx4-jj5v-6mff) · 2023-07-14
v2/pkg/protocols/common/generators/load.go· sinkloadPayloads· fix: sandbox isolation
Historical Vulnerability Classes
| Class | Fixes | Verified | Most recent fix |
|---|---|---|---|
| SSRF | 3 | 0 | 2026-10-18 1c0f77d28e |
| Arbitrary File Access | 1 (1 component gone, not counted) | 2 | 2026-06-19 634cecbb28 |
| Code Execution | 2 | 2 | 2026-06-30 ccbfb12bd0 |
| Sandbox Escape | 2 | 0 | 2026-06-24 3a8b65cb45 |
| Signature Verification Bypass | 2 | 2 | 2026-07-03 fac0b7196d |
| Information Disclosure | 1 | 0 | 2026-08-03 a20aa26024 |
| Path Traversal | 1 | 0 | 2026-06-04 20cbf0bd73 |
| SQL Injection | 1 | 0 | 2026-06-23 68daef44a7 |
Known Advisories
Linked to a fix commit in this history (5)
- CVE-2026-76805 / GHSA-jpvm-9frm-hjcq (medium 5.3) CWE-200 — fixed in ccbfb12bd0, d221732016
- Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode. A vulnerability in Nuclei's DAST/fuzz expression evaluation path allows a malicious target server to trigger disclosure of ...
- CVE-2026-76803 / GHSA-xhmx-w2j4-rw3q (medium 5.3) CWE-284 — fixed in 634cecbb28
- Local File Read via MySQL Client Sandbox Bypass. A vulnerability in Nuclei's JavaScript MySQL client library allows arbitrary local file reads that bypass the
-allow-local-file-access(-lfa) sandb...
- Local File Read via MySQL Client Sandbox Bypass. A vulnerability in Nuclei's JavaScript MySQL client library allows arbitrary local file reads that bypass the
- CVE-2026-76819 / GHSA-vxg7-f2jj-jmqm (high 8.6) CWE-94,CWE-787 — fixed in fac0b7196d
- Arbitrary Code Execution via Goja JavaScript Engine Vulnerability. A vulnerability in the Goja JavaScript engine used by Nuclei's
javascript:protocol allows arbitrary native code execution on the s...
- Arbitrary Code Execution via Goja JavaScript Engine Vulnerability. A vulnerability in the Goja JavaScript engine used by Nuclei's
- CVE-2024-43405 / GHSA-7h5p-mmpp-hgmm (high 7.4) CWE-78 — fixed in 0da993afe6
- Nuclei Template Signature Verification Bypass. ## Summary A vulnerability has been identified in Nuclei's template signature verification system that could allow an attacker to bypass the signature ch...
- CVE-2023-37896 / GHSA-2xx4-jj5v-6mff (medium 5.9) CWE-22 — fixed in e5154d362a
- Nuclei < 2.9.9 - Sandbox restriction bypass. ## Overview Affected: < 2.9.9 (patched 2.9.9).
Without a linked fix commit (6)
Published elsewhere, fixed before the history window, or not yet linked; full descriptions are in the JSON context.
| Advisory | Severity | Published | CWE | Summary |
|---|---|---|---|---|
| CVE-2026-76804 / GHSA-qgw5-7j4f-fg97 | medium 5.5 | 2026-07-16 | CWE-284 | Local File Read via Workflow File-Protocol Gate Bypass. A vulnerability in Nuclei's workfl... |
| CVE-2026-76802 / GHSA-jpf4-98qj-qr67 | medium 4.7 | 2026-07-16 | CWE-78 | Arbitrary Command Execution via DAST Code Signature Bypass. A vulnerability in Nuclei's DA... |
| CVE-2026-41645 / GHSA-jm34-66cf-qpvr | medium 5.3 | 2026-04-18 | CWE-94 | Environment variable disclosure via Response-Derived DSL Expressions. A vulnerability in N... |
| CVE-2026-41646 / GHSA-29rg-wmcw-hpf4 | medium 5.5 | 2026-04-18 | CWE-284 | Local File Read via require() Module Loader Bypass. A vulnerability in Nuclei's JavaScript... |
| CVE-2024-40641 / GHSA-c3q9-c27p-cw9h | high 7.4 | 2024-07-17 | CWE-78 | Unsigned code template execution through workflows in projectdiscovery/nuclei. ### Summary... |
| CVE-2024-27920 / GHSA-w5wx-6g2r-r78q | high 7.4 | 2024-03-15 | CWE-78 | Unsigned code template execution through workflows in projectdiscovery/nuclei. ### Overvie... |
Fixed-issue fingerprints and advisory matches are derived from git history and published advisories; the risk tables and pattern descriptions above are derived from them and should be verified against the cited commits.