CVE-2024-27920: Projectdiscovery Nuclei RCE Vulnerability

CVE-2024-27920 Overview

CVE-2024-27920 affects projectdiscovery/nuclei, a fast and customizable vulnerability scanner based on a YAML-based domain-specific language (DSL). Nuclei v3 executes unsigned code templates through workflows, bypassing the template signature verification that normally protects users from untrusted code. Users running custom workflows can be tricked into executing malicious code on their local system. The issue is fixed in Nuclei v3.2.0. The underlying weakness is classified as OS Command Injection [CWE-78].

Critical Impact
Custom Nuclei workflows can execute unsigned code templates, enabling arbitrary command execution on the scanner operator's host with the privileges of the Nuclei process.

Affected Products

ProjectDiscovery Nuclei v3.x prior to v3.2.0
Deployments using custom workflow templates
Automation pipelines and CI/CD systems invoking Nuclei with untrusted workflows

Discovery Timeline

2024-03-15 - CVE-2024-27920 published to the National Vulnerability Database (NVD)
2024-03-15 - ProjectDiscovery publishes GitHub Security Advisory GHSA-w5wx-6g2r-r78q and releases Nuclei v3.2.0
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-27920

Vulnerability Analysis

Nuclei templates support a code protocol that lets template authors run arbitrary scripts on the host executing the scan. To prevent untrusted templates from abusing this capability, Nuclei validates a cryptographic signature attached to each code template and refuses to run unsigned ones. The vulnerability breaks that guarantee when templates are invoked indirectly through workflows.

A workflow is a higher-level template that references other templates and orchestrates their execution. In vulnerable versions, the workflow execution path did not enforce the same signature verification applied during direct template invocation. As a result, an attacker-supplied workflow could reference an unsigned code template and cause Nuclei to execute it. See the ProjectDiscovery Protocols Documentation and Template Signing Reference for the intended trust model.

Root Cause

The root cause is missing signature validation in the workflow executor. Template signing was enforced at the direct-template entry point but not at the workflow-to-template dispatch layer, allowing unsigned code templates to be executed when reached through a workflow reference.

Attack Vector

Exploitation requires local execution of a malicious or attacker-controlled workflow file and user interaction, since the operator must invoke Nuclei against the crafted workflow. Common delivery scenarios include shared workflow repositories, community template collections, and pipeline configurations that pull workflows from untrusted sources. Once loaded, the workflow references an unsigned code template that executes shell commands under the user account running Nuclei.

No verified public exploit code has been published. The remediation details are available in GitHub Pull Request #4822.

Detection Methods for CVE-2024-27920

Indicators of Compromise

Execution of nuclei binaries with versions below v3.2.0 and a -workflows or -w flag pointing at non-vendor paths
Presence of workflow YAML files that reference templates using the code: protocol without a digest: signature field
Unexpected child processes (shells, interpreters such as bash, sh, python, powershell) spawned by the nuclei process
Outbound network connections from hosts running Nuclei to domains not associated with the intended scan targets

Detection Strategies

Inventory Nuclei installations across developer workstations, security tooling hosts, and CI/CD runners, and flag any version earlier than v3.2.0
Alert on process lineage where nuclei is the parent of shell or scripting interpreters, which indicates code protocol execution
Scan workflow and template repositories for code: blocks lacking accompanying signature metadata

Monitoring Recommendations

Log full command-line arguments for nuclei invocations to capture workflow paths and template sources
Monitor file integrity of workflow directories to detect substitution of trusted workflows with malicious variants
Track egress from CI/CD runners executing Nuclei so anomalous callbacks from injected code templates are visible

How to Mitigate CVE-2024-27920

Immediate Actions Required

Upgrade Nuclei to v3.2.0 or later on every host that runs the scanner, including CI/CD build agents
Audit existing workflow files and remove any that reference unsigned or untrusted code templates
Restrict who can commit or modify workflow files in shared repositories and require code review for workflow changes

Patch Information

ProjectDiscovery addressed the vulnerability in Nuclei v3.2.0 by enforcing template signature verification on the workflow execution path. The fix is described in GitHub Pull Request #4822 and the GitHub Security Advisory GHSA-w5wx-6g2r-r78q. Refer to the ProjectDiscovery Workflows Overview for guidance on safe workflow authoring.

Workarounds

Refrain from running custom workflows until the upgrade to v3.2.0 is complete
Execute Nuclei only with trusted, signed templates and workflows sourced from the official ProjectDiscovery repository
Run Nuclei under a low-privilege service account inside an isolated container or sandbox to limit the blast radius of any code execution

bash

# Verify the installed Nuclei version and upgrade if below v3.2.0
nuclei -version

# Upgrade using the official installer
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

# Run Nuclei restricted to signed templates from the official template repo
nuclei -t ~/nuclei-templates/ -no-interactsh -disable-update-check