CVE-2026-41646 projectdiscovery CVE debrief

Who should care

Defenders responsible for Nuclei installations should assess exposure and verify patch deployment. They should prioritize verifying Nuclei version 3.8.0 or later and restricting access to sensitive files. Defenders should also monitor for potential unauthorized file access and review compensating controls for exposed systems.

Why it matters

Defenders should care about CVE-2026-41646 because it allows unauthorized file access in Nuclei installations prior to version 3.8.0, potentially impacting sensitive file confidentiality. Verification of Nuclei version and patch deployment is necessary.

• Potential unauthorized file access
• Need to verify Nuclei version and patch deployment
• Possible impact on sensitive file confidentiality

Technical summary

The vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require() function, bypassing the default local file access restriction. This issue affects Nuclei versions from 3.0.0 to before 3.8.0. The vulnerability allows unauthorized file access, potentially impacting sensitive file confidentiality. Defenders should prioritize verifying Nuclei version 3.8.0 or later and restricting access to sensitive files. The issue has been patched in version 3.8.0.

Defensive priority

Defenders should prioritize verifying Nuclei version 3.8.0 or later and restricting access to sensitive files.

Recommended defensive actions

• Verify Nuclei version 3.8.0 or later is in use
• Restrict access to sensitive files
• Monitor for potential unauthorized file access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and patch. However, additional information on potential exploitation or impact is limited. Defenders should verify Nuclei version 3.8.0 or later and restrict access to sensitive files. The vulnerability allows JavaScript templates to read local files, bypassing access restrictions. There is no evidence of exploitation, but defenders should monitor for potential unauthorized file access.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.