CVE-2026-92718: Nuclei Template Signature Bypass RCE Vulnerability

CVE-2026-92718 Overview

CVE-2026-92718 affects Nuclei, the open-source vulnerability scanner maintained by ProjectDiscovery. Versions from 3.7.0 before 3.11.1 cache template signature verification results using only file modification time. The cache does not include a content checksum, so an attacker who can write to the template directory can replace a verified template with malicious content and restore the original mtime to bypass signature enforcement. Successful exploitation allows arbitrary operating system command execution through Nuclei's JavaScript and code template protocols. The flaw is tracked under CWE-347: Improper Verification of Cryptographic Signature.

Critical Impact

A local attacker with write access to the Nuclei template cache directory can execute arbitrary OS commands under the identity of the user running Nuclei scans.

Affected Products

• Nuclei 3.7.0 through 3.11.0 (ProjectDiscovery)
• Automation pipelines and CI/CD runners invoking vulnerable Nuclei versions
• Shared scanning hosts where multiple users can write to Nuclei's template cache

Discovery Timeline

• 2026-09-16 - CVE-2026-92718 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92718

Vulnerability Analysis

Nuclei compiles and executes YAML-based templates, several of which invoke JavaScript through the js protocol or shell commands through the code protocol. To avoid re-verifying signatures on every scan run, Nuclei caches verification metadata for each template on disk. In vulnerable releases, the cache key relies on the template path, size, and modification time recorded in pkg/catalog/index/metadata.go.

Because file modification time is attacker-controllable through standard filesystem APIs such as utimes(2) or touch -t, the cache trusts a signal that offers no cryptographic guarantee. An attacker who overwrites a previously verified template with malicious YAML and then restores the original mtime produces a cache hit. Nuclei skips signature validation and passes the payload to the code or JavaScript execution path in pkg/templates/compile.go, yielding arbitrary command execution.

Root Cause

The root cause is a signature verification cache that binds trust to filesystem metadata rather than to content. No SHA-256 digest of the template body was stored alongside the verifier identifier, so the cache could not detect content substitution when timestamps were preserved.

Attack Vector

Exploitation requires local write access to the Nuclei template directory and user interaction to trigger a scan. The attacker replaces a signed template, resets its modification time to the cached value, and waits for the next Nuclei execution. Nuclei loads the tampered template as verified and executes the embedded commands.

// Patch: pkg/catalog/index/metadata.go
// TemplateVerifier is the verifier used for the template.
TemplateVerifier string `gob:"verifier,omitempty"`

// VerifierFingerprint identifies the public key that verified the template.
VerifierFingerprint [32]byte `gob:"verifier_fingerprint,omitempty"`

// ContentDigest binds the cached verification result to the content that
// was verified.
ContentDigest [32]byte `gob:"content_digest,omitempty"`

// Validation records how the built-in parser validated this metadata's
// source before it was cached.
Validation ValidationMode `gob:"validation,omitempty"`

Source: ProjectDiscovery Nuclei commit 9de96e4. The patch adds a ContentDigest field so cached verification is bound to the template bytes, and bumps IndexVersion from 1 to 2 to invalidate legacy caches.

Detection Methods for CVE-2026-92718

Indicators of Compromise

• Nuclei template files in ~/.config/nuclei/ or custom template directories whose content hash does not match the upstream signed template while retaining the original modification time.
• Unexpected child processes spawned by the nuclei binary, such as sh, bash, powershell.exe, or interpreters invoked outside normal scan behavior.
• Presence of Nuclei templates using the code: or js: protocol that were not sourced from the official ProjectDiscovery templates repository.

Detection Strategies

• Compute SHA-256 hashes of local templates and compare them against the official Nuclei templates repository baseline to identify content drift.
• Monitor process lineage for nuclei spawning shells or scripting hosts, and correlate with recent writes to the template cache directory.
• Alert on file writes to the Nuclei template directory by user accounts that are not authorized to manage scanning content.

Monitoring Recommendations

• Enable filesystem auditing on Nuclei template and cache directories, including changes to file timestamps via utimensat and utimes syscalls.
• Log Nuclei version strings from CI/CD job output and flag any runner still executing versions below 3.11.1.
• Ship endpoint telemetry to a central data lake and hunt for nuclei executions that precede outbound network connections or credential access.

How to Mitigate CVE-2026-92718

Immediate Actions Required

• Upgrade all Nuclei installations to version 3.11.1 or later, which introduces content-digest binding and increments the cache IndexVersion to invalidate poisoned entries.
• Delete existing Nuclei cache files under the user's config directory to force re-verification of every template on the next scan.
• Restrict write permissions on template directories to trusted administrators and remove world-writable ACLs on shared scanning hosts.

Patch Information

The fix is delivered in Nuclei 3.11.1 via commit 9de96e4dda5a03da963b9ae6582f03ea55791a76. The patch adds ContentDigest and VerifierFingerprint fields to cache metadata and rejects entries whose stored digest does not match a fresh hash of the template content. Additional context is available in the VulnCheck advisory and the Nuclei issue discussion.

Workarounds

• Run Nuclei with the -disable-cache behavior by clearing the template cache directory before each scan when upgrading is not immediately possible.
• Execute Nuclei only from ephemeral, isolated containers where the template directory is mounted read-only from a trusted source.
• Enforce template signing policies and refuse to load unsigned or third-party templates through the -signature and template source configuration flags.

# Upgrade Nuclei and invalidate the poisoned cache
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@v3.11.1
rm -rf "$HOME/.config/nuclei/.templates-index"
rm -rf "$HOME/.cache/nuclei"
nuclei -version
nuclei -update-templates