CVE-2026-41282 Code injection in Nuclei
Attackers can execute arbitrary code via DSL injection in ProjectDiscovery Nuclei when using non-default environment variable features against untrusted targets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41282?
CVE-2026-41282 is a medium-severity code injection vulnerability in ProjectDiscovery Nuclei, published on 20 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untrusted targets (not the default configuration).
Weakness: CWE-94
Which versions are affected by CVE-2026-41282?
It affects 1 product.
Products include Projectdiscovery Nuclei.
How do I fix CVE-2026-41282?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-41282 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41282 exists.
Other vulnerabilities in ProjectDiscovery Nuclei
- CVE-2023-37896 Nuclei Path Traversal vulnerability
- CVE-2024-43405 Nuclei Template Signature Verification Bypass
- CVE-2024-27920 Unsigned code template execution through workflows in projectdiscovery/nuclei
- CVE-2026-41646 Nuclei: Local File Read via require() Module Loader Bypass
- CVE-2026-41645 Nuclei: Environment variable disclosure via Response-Derived DSL Expressions
Sources
Also known as GHSA-vrr8-h7fq-ghr8.