High 7.4Published Mar 15, 2024

CVE-2024-27920projectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL.

Updated under an hour ago (Nov 2, 2026, 1:40 AM ET)

Does this affect you?

It affects projectdiscovery nuclei. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for projectdiscovery nuclei Exploited in the last 30 days

projectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL. A significant security oversight was identified in Nuclei v3, involving the execution of unsigned code templates through workflows. This vulnerability specifically affects users utilizing custom workflows, potentially allowing the execution of malicious code on the user's system. This advisory outlines the impacted users, provides details on the security patch, and suggests mitigation strategies. The vulnerability is addressed in Nuclei v3.2.0. Users are strongly recommended to update to this version to mitigate the security risk. Users should refrain from using custom workflows if unable to upgrade immediately. Only trusted, verified workflows should be executed.

CVSS: 7.4 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness (CWE): CWE-78
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Analyzed
Record last updated: Jun 17, 2026
First seen by InfoSec Signals: Nov 1, 2026

Affected products

Affected products

projectdiscovery nuclei projectdiscovery:nuclei	from 3.0.0 before 3.2.0	NVD

References

References

https://docs.projectdiscovery.io/templates/protocols/code	technical-description
https://docs.projectdiscovery.io/templates/reference/template-signing	technical-description
https://docs.projectdiscovery.io/templates/workflows/overview	technical-description
https://github.com/projectdiscovery/nuclei/pull/4822	issue-tracking
https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-w5wx-6g2r-r78q	vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.