---
id: CVE-2026-76803
title: Nuclei is a vulnerability scanner built on a simple YAML-based DSL
summary: >-
  Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0
  until 3.10.0, the nuclei/mysql JavaScript library does not enforce the
  local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL
  DSN opti…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'
cwe:
  - CWE-284
vendor: projectdiscovery
product: nuclei
affected:
  - 'nuclei >= 3.0.0, < 3.10.0'
patched:
  - github.com/projectdiscovery/nuclei/v3 3.10.0
published: '2026-09-22'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:20:08.527'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76803'
references:
  - url: >-
      https://github.com/projectdiscovery/nuclei/commit/9611926a9a1ca99e8ed554d1b26fbeff60e06368
    label: security-advisories@github.com
  - url: 'https://github.com/projectdiscovery/nuclei/pull/7473'
    label: security-advisories@github.com
  - url: 'https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-xhmx-w2j4-rw3q
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76803'
  - url: 'https://github.com/advisories/GHSA-xhmx-w2j4-rw3q'
  - url: 'https://github.com/projectdiscovery/nuclei'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-76803.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-76803'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-76803'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
  - osv
  - csaf
  - vex
  - red-hat
epss: 0.00401
epssPercentile: 0.31574
aliases:
  - GHSA-xhmx-w2j4-rw3q
ecosystem: go
ingestedAt: '2026-09-22T17:07:07.381Z'
---

## Overview

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an attacker-controlled MySQL-compatible endpoint can cause the server to issue LOAD DATA LOCAL INFILE requests for arbitrary paths, after which the scanner's MySQL client reads the files and returns their contents to the server even though -allow-local-file-access is disabled. JavaScript templates can run unsigned and without the -code flag on affected versions, and the bypass affects CLI and SDK deployments that accept untrusted templates. This issue is fixed in version 3.10.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-76803)

Affected packages:

- `github.com/projectdiscovery/nuclei/v3 >= 3.0.0, < 3.10.0`

Patched in:

- `github.com/projectdiscovery/nuclei/v3 3.10.0`

Source: https://github.com/advisories/GHSA-xhmx-w2j4-rw3q

## Vendor advisories

- **Red Hat VEX** · updated 2026-09-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-76803.json)