GO-2026-6574 Nuclei: Local File Read via Workflow File-Protocol Gate Bypass in github.com/projectdiscovery/nuclei

Nuclei: Local File Read via Workflow File-Protocol Gate Bypass in github.com/projectdiscovery/nuclei...

GO-2026-6577 Nuclei: Local File Read via MySQL Client Sandbox Bypass in github.com/projectdiscovery/nuclei

Nuclei: Local File Read via MySQL Client Sandbox Bypass in github.com/projectdiscovery/nuclei...

PT-2026-105589

Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass in github.com/projectdiscovery/nuclei...

PT-2026-105594

Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability in github.com/projectdiscovery/nuclei...

PT-2026-105593

Nuclei: Local File Read via Workflow File-Protocol Gate Bypass in github.com/projectdiscovery/nuclei...

Arbitrary Code Execution

github.com/projectdiscovery/nuclei is vulnerable to Arbitrary Code Execution. The vulnerability is due to improper validation of signed workflows within the parseWorkflowTemplate function in workflows.go, which allows the execution of unsigned code templates through workflows...