CVE-2026-41646 MEDIUM

CVE-2026-41646: Nuclei: Local File Read via require() Module Loader Bypass

Vendor Projectdiscovery
Product nuclei
Weakness CWE-284
Published May 8, 2026
Last update May 8, 2026
View on NVD All CVEs

CVSS base score

5.5/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require() function, bypassing the default local file access restriction. This issue has been patched in version 3.8.0.

Key dates

02Disclosure timeline

May 8, 2026 CVE published
May 8, 2026 Record updated