CVE-2026-76802: Nuclei Vulnerability Scanner RCE Vulnerability

CVE-2026-76802 Overview

CVE-2026-76802 is a command injection vulnerability [CWE-78] in ProjectDiscovery Nuclei, a YAML-based vulnerability scanner. The Dynamic Application Security Testing (DAST) template loading branch fails to enforce the unsigned code-template signature check when a template combines a fuzzing: block with an unsigned code: block. Operators running Nuclei with the -dast flag can load an attacker-supplied multiprotocol template that queues an unsigned code request and executes arbitrary shell commands. The bypass works without the -code flag and without a valid cryptographic signature. The issue affects Nuclei versions 3.0.0 through 3.9.x and is fixed in version 3.10.0.

Critical Impact
Attackers who can supply templates to a DAST scan gain arbitrary shell command execution on the scanner host, bypassing Nuclei's code-signing trust model.

Affected Products

ProjectDiscovery Nuclei 3.0.0 through 3.9.x (CLI DAST scans)
Nuclei SDK integrations that enable DAST while accepting attacker-supplied templates
Any automation pipeline that ingests third-party YAML templates and invokes -dast

Discovery Timeline

2026-09-22 - CVE-2026-76802 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-76802

Vulnerability Analysis

Nuclei enforces a code-signing trust model for templates that contain a code: block, since these templates execute arbitrary shell commands on the scanner host. Unsigned or tampered code templates are normally rejected during template loading. The DAST loading branch in pkg/catalog/loader/loader.go did not apply this signature check before accepting multiprotocol templates. A template that declared both a fuzzing: block and a code: block passed the DAST filter and reached the execution queue without signature verification. Once queued, the code request ran with the privileges of the Nuclei process.

Root Cause

The root cause is a missing precondition check in the DAST-specific template loading path. The general template loader validated HasCodeRequest() against Verified status, but the DAST branch executed earlier in the control flow and did not reapply the same gate. Templates that qualified for DAST processing therefore bypassed the tamper and unsigned-template counters that would otherwise skip them.

Attack Vector

Exploitation requires an operator to run Nuclei with -dast and to load a template supplied by an untrusted party. The attacker crafts a YAML template combining a fuzzing: directive with a code: directive containing shell commands. When the scan begins, Nuclei loads the template through the DAST branch, skips the signature verification, and executes the embedded commands. The attack vector is local because template files must be delivered to the scanner host, but SDK integrations that accept remote template input widen the exposure surface.

						stats.Increment(templates.SkippedRequestSignatureStats)
						return
					}
+
+					// 'Code' protocol templates run arbitrary commands, so an
+					// unsigned one must never load regardless of the loading path
+					// (e.g. the DAST branch below) that follows.
+					if parsed.HasCodeRequest() && !parsed.Verified && !parsed.HasWorkflows() {
+						stats.Increment(templates.SkippedCodeTmplTamperedStats)
+						// these will be skipped so increment skip counter
+						stats.Increment(templates.SkippedUnsignedStats)
+						if config.DefaultConfig.LogAllEvents {
+							store.logger.Print().Msgf("[%v] Tampered/Unsigned template at %v.\n", aurora.Yellow("WRN").String(), templatePath)
+						}
+						return
+					}
+
					// DAST only templates
					// Skip DAST filter when loading auth templates
					if store.ID() != AuthStoreId && typesOpts.DAST {

Source: GitHub Commit 1c440e7. The patch inserts the unsigned code-template check before the DAST branch so tampered templates are counted and skipped regardless of the loading path.

Detection Methods for CVE-2026-76802

Indicators of Compromise

Nuclei log entries containing Tampered/Unsigned template at after upgrading to 3.10.0, indicating a rejected exploitation attempt.
Unexpected child processes spawned by the Nuclei binary during a DAST scan, such as shells, curl, wget, or interpreter processes.
YAML template files on disk that contain both a fuzzing: block and a code: block without a valid # digest: signature line.

Detection Strategies

Inspect template repositories and scan inputs for multiprotocol templates that combine fuzzing: and code: sections.
Enable LogAllEvents in the Nuclei configuration to record signature verification outcomes and skipped templates.
Correlate process telemetry from scanner hosts to identify shell command execution originating from the Nuclei process tree.

Monitoring Recommendations

Track the Nuclei binary version deployed across CI runners, security tooling containers, and analyst workstations.
Alert on execution of Nuclei with the -dast flag against template paths that resolve outside the trusted nuclei-templates repository.
Monitor egress connections from scanner hosts for anomalous destinations that could indicate command execution payloads.

How to Mitigate CVE-2026-76802

Immediate Actions Required

Upgrade Nuclei to version 3.10.0 or later on all systems that run DAST scans.
Audit template sources and remove any YAML files supplied by untrusted parties from scan directories.
Restrict who can submit templates to shared scanning pipelines and require code review for any template containing a code: block.

Patch Information

The fix is available in Nuclei Release v3.10.0 via Pull Request #7472. Details are documented in GitHub Security Advisory GHSA-jpf4-98qj-qr67. The patch enforces the unsigned code-template check before the DAST loading branch executes.

Workarounds

Disable DAST scanning by omitting the -dast flag until the upgrade to 3.10.0 is complete.
Load templates only from the official ProjectDiscovery nuclei-templates repository or an internal repository under strict change control.
Run Nuclei inside a least-privilege container with no outbound network access to limit the impact of arbitrary command execution.

bash

# Verify the installed Nuclei version and upgrade if below 3.10.0
nuclei -version

# Upgrade using the official installer
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@v3.10.0

# Run DAST scans only against trusted, signed templates
nuclei -dast -t /opt/nuclei-templates/dast/ -include-tags fuzz