CVE-2026-41646CWE-284

Nuclei: Local File Read via require() Module Loader Bypass

Medium · published May 8, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
4.7
In the wild
Unconfirmed
What it is

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require() function, bypassing the default local file access restriction. This issue has been patched in version 3.8.0.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00159 · 4.7th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-05-08T03:14Z
EPSS history
Timeline
  • 08 MAY 03:14Z
    Nuclei: Local File Read via require() Module Loader Bypass
    cvelistv5