CVE-2026-41282
ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection.
Published Apr 20, 2026 · updated Jun 17, 2026 · projectdiscovery nuclei
ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untrusted targets (not the default configuration).
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 20, 2026 · NIST NVD
Detected
ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untrusted targets (not the default configuration).
Jun 17, 2026 · NIST NVD
Updated
ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untrusted targets (not the default configuration).
Affected
- cpe projectdiscovery/nucleiversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-41282
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-41282
ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untrusted targets (not the default configuration).
nvd.nist.gov