CVE-2026-41645: 
NixOS vulnerability analysis and mitigation

CVE-2026-41645 is a DSL expression injection vulnerability in ProjectDiscovery Nuclei, a widely used open-source vulnerability scanner built on a YAML-based DSL. Affecting versions 3.0.0 through 3.7.x (before 3.8.0), the flaw allows a malicious target server to inject and execute supported DSL expressions by embedding helper/function syntax in HTTP responses that are subsequently reused by multi-step templates. The vulnerability was reported by researcher @gnuletik via responsible disclosure and the advisory was published on April 18, 2026, with the CVE assigned on May 8, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The vulnerability resides in expressions.Evaluate() at pkg/protocols/common/expressions/ and in the hasLiteralsOnly() unresolved-variable validation path. The two-pass evaluation design first replaces placeholders with values (including HTTP response data), then scans the substituted output for DSL expressions — meaning response-derived content containing {{helper_syntax}} is reinterpreted and executed as a DSL expression on the second pass. A secondary issue in hasLiteralsOnly() caused it to evaluate helper expressions (with side effects) while merely checking whether {{...}} contained unresolved variables. When the -env-vars / -ev flag is explicitly enabled, environment variables are merged into the template variable map, allowing a malicious server to return payloads like {{API_KEY}} that resolve to actual host environment variable values in subsequent template requests (GitHub Advisory, PR #7221, PR #7321).

The primary impact is high confidentiality loss: when -env-vars (-ev) is enabled, a malicious target server can exfiltrate sensitive host environment variables — including API keys, credentials, and tokens — from the machine running Nuclei. Without -ev enabled (the default), injected DSL expressions may still trigger helper functions (e.g., {{md5("test")}}), but this has no meaningful security impact beyond unexpected behavior. The vulnerability affects CLI users running multi-step templates with extractors or flow-based request chaining against untrusted targets, as well as SDK users who have set EnvironmentVariables: true in their integration (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.037%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity: the attacker must control a target server that Nuclei scans, the victim must be running a multi-step template that reuses response-derived values, and the -ev flag must be explicitly enabled for the sensitive information disclosure to occur (GitHub Advisory, Feedly).

1. Set up a malicious server: Deploy an HTTP server under attacker control that returns HTTP responses containing Nuclei DSL expression syntax, such as {{API_KEY}} or {{env_var_name}} in the response body.
2. Identify a vulnerable Nuclei user: Target a security researcher or automated pipeline running Nuclei v3.0.0–v3.7.x with the -env-vars / -ev flag enabled and using multi-step templates that extract and reuse response data.
3. Craft the injection payload: Ensure the malicious server's response body contains DSL expressions referencing environment variable names of interest (e.g., {{AWS_SECRET_ACCESS_KEY}}, {{GITHUB_TOKEN}}). These will be captured by Nuclei's extractor in the first template step.
4. Trigger expression re-evaluation: When Nuclei's multi-step template reuses the extracted response value in a subsequent request (e.g., as a query parameter or POST body), expressions.Evaluate() re-evaluates the attacker-controlled string as a DSL expression, resolving the environment variable reference.
5. Exfiltrate the resolved value: The resolved environment variable value is sent to the attacker's server as part of the subsequent HTTP request (e.g., in a URL parameter or request body), completing the exfiltration (GitHub Advisory, PR #7221).

• Network: Outbound HTTP requests from the Nuclei host to an unexpected or attacker-controlled server containing URL-encoded DSL expression syntax (e.g., %7B%7BAWS_SECRET_ACCESS_KEY%7D%7D decoded to {{AWS_SECRET_ACCESS_KEY}}) or resolved secret values in query parameters or POST bodies.
• Logs: Nuclei scan logs showing multi-step template execution against an external target where extracted values contain {{...}} patterns; subsequent requests in the same scan containing resolved environment variable values.
• Process: Nuclei process invoked with the -ev or -env-vars flag in combination with multi-step templates targeting external or untrusted hosts — visible in process argument lists or CI/CD pipeline logs.

Upgrade to Nuclei v3.8.0, which fixes the vulnerability by collecting expressions from the original template text before placeholder substitution, ensuring only template-authored expressions are evaluated and response-derived data is treated as literal text. The fix also corrects hasLiteralsOnly() to use a Vars() length check instead of runtime evaluation, eliminating side-effectful helper execution during validation. As an immediate workaround for users who cannot upgrade, disable the -env-vars / -ev flag when running multi-step templates against untrusted or attacker-controlled targets — standard configurations without this flag are not affected by the information disclosure risk (GitHub Advisory, Nuclei v3.8.0 Release).

The vulnerability was responsibly disclosed by researcher @gnuletik to ProjectDiscovery via security@projectdiscovery.io and acknowledged in the official GitHub Security Advisory published by maintainer @ehsandeep. The NixOS/nixpkgs project tracked the issue and opened a related update PR (#512401) to update the packaged version. No significant broader media coverage or notable social media discussion beyond standard CVE tracking feeds has been observed (GitHub Advisory).