CVE-2024-40641

Nuclei is a fast and customizable vulnerability scanner based on simple YAML based DSL. In affected versions it a way to execute code template without -code option and signature has been discovered. Some web applications inherit from Nuclei and allow users to edit and execute workflow files. In...

CVE-2024-40641

Nuclei (projectdiscovery/nuclei) has a CVE-2024-40641 OS Command Injection vector where unsigned code templates can execute via workflows, exposing arbitrary commands when users can edit/execute workflow files. Connected advisories confirm the root cause is code-template execution without the -co...