https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 16:53:24 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-310021 EUVD-2026-310021 https://cve.radiocsirt.org/vuln/euvd-2026-310021 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41645 <p>Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei&#39;s expression evaluation engine makes it possible for a malicious target server to inject and execute supported DSL expressions. This happens when HTTP response data containing helper/function syntax gets reused by multi-step templates. If the -env-vars / -ev option is explicitly enabled, this can expose host environment variables. That option is off by default, so standard configurations are not affected by the information disclosure risk. This issue has been patched in version 3.8.0.</p> <p>Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei&#39;s expression evaluation engine makes it possible for a malicious target server to inject and execute supported DSL expressions. This happens when HTTP response data containing helper/function syntax gets reused by multi-step templates. If the -env-vars / -ev option is explicitly enabled, this can expose host environment variables. That option is off by default, so standard configurations are not affected by the information disclosure risk. This issue has been patched in version 3.8.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41645 https://cve.radiocsirt.org/vuln/ghsa-jm34-66cf-qpvr <p><strong>Affected:</strong> Go: github.com/projectdiscovery/nuclei/v3</p> <p>A vulnerability in Nuclei&#39;s expression evaluation engine makes it possible for a malicious target server to inject and execute supported DSL expressions. This happens when HTTP response data containing helper/function syntax gets reused by multi-step templates. If the `-env-vars` / `-ev` option is explicitly enabled, this can expose host environment variables. That option is off by default, so standard configurations are not affected by the information disclosure risk.</p> <p>**Affected Component**</p> <p>The issue lives in `expressions.Evaluate()` at `pkg/protocols/common/expressions/` and in the unresolved-variable validation path (`hasLiteralsOnly()`).</p> <p>**Description**</p> <p>`expressions.Evaluate()` replaces placeholders first, then scans the substituted output for expressions. Because of this two-pass approach, response-derived values (including extractor output and response body content) can be reinterpreted as DSL/helper syntax on the second pass.</p> <p>When `-env-vars` (`-ev`) is enabled, environment variables get merged into the template variable map. A malicious target can return response data containing expressions like `{{env_var_name}}` which, when reused in a subsequent template request, resolve to actual environment variable values. This can expose sensitive host data like API keys, credentials, and tokens.</p> <p>Without `-ev` enabled (the default), injected DSL expressions may still trigger helper functions such as `{{md5(&#34;test&#34;)}}`, but this has no meaningful security impact beyond une…</p> <p><strong>Affected:</strong> Go: github.com/projectdiscovery/nuclei/v3</p> <p>A vulnerability in Nuclei&#39;s expression evaluation engine makes it possible for a malicious target server to inject and execute supported DSL expressions. This happens when HTTP response data containing helper/function syntax gets reused by multi-step templates. If the `-env-vars` / `-ev` option is explicitly enabled, this can expose host environment variables. That option is off by default, so standard configurations are not affected by the information disclosure risk.</p> <p>**Affected Component**</p> <p>The issue lives in `expressions.Evaluate()` at `pkg/protocols/common/expressions/` and in the unresolved-variable validation path (`hasLiteralsOnly()`).</p> <p>**Description**</p> <p>`expressions.Evaluate()` replaces placeholders first, then scans the substituted output for expressions. Because of this two-pass approach, response-derived values (including extractor output and response body content) can be reinterpreted as DSL/helper syntax on the second pass.</p> <p>When `-env-vars` (`-ev`) is enabled, environment variables get merged into the template variable map. A malicious target can return response data containing expressions like `{{env_var_name}}` which, when reused in a subsequent template request, resolve to actual environment variable values. This can expose sensitive host data like API keys, credentials, and tokens.</p> <p>Without `-ev` enabled (the default), injected DSL expressions may still trigger helper functions such as `{{md5(&#34;test&#34;)}}`, but this has no meaningful security impact beyond une…</p> https://cve.radiocsirt.org/vuln/ghsa-jm34-66cf-qpvr