CVE-2026-76802: Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template signature check before accepting a template that contains both a fuzzing: block and an unsigned code: block. When an operator enables -dast, an untrusted multiprotocol template can place an unsigned code request into the execution queue and run arbitrary shell commands even without -code or a valid cryptographic signature. The issue affects CLI DAST scans and SDK integrations that enable DAST while accepting attacker-supplied templates. This issue is fixed in version 3.10.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nucleito a version that resolves this vulnerability.Fixed in 3.10.0
Event History
Frequently Asked Questions
Which deployments are exposed?
CLI DAST scans and SDK integrations are affected when they enable DAST and accept attacker-supplied multiprotocol templates. The vulnerable path requires the operator to use the -dast option.
What must an attacker provide to execute commands?
An attacker needs to supply an untrusted multiprotocol template containing both a fuzzing: block and an unsigned code: block. The template can then queue an unsigned code request and execute arbitrary shell commands without -code or a valid cryptographic signature.
Are installations that do not enable DAST affected by this bypass?
The described vulnerable branch is the DAST template-loading path, and exploitation requires -dast to be enabled. The provided information does not identify non-DAST scans as affected.
What version fixes the issue?
Version 3.10.0 fixes the issue. Versions from 3.0.0 until 3.10.0 are identified as affected.