CVE-2026-92718

Nuclei, the open-source template-based vulnerability scanner from ProjectDiscovery, caches the result of template code-signature verification keyed only on a file's modification time, with no content checksum involved. An attacker with local write access to the templates directory can replace a previously verified template with unsigned malicious content and restore the original modification timestamp, causing the cached 'verified' state to be reused for the tampered file. When a user then runs a scan using that template, Nuclei executes it, giving the attacker arbitrary operating-system command execution with the privileges of the user running the scanner. All users running Nuclei versions prior to 3.11.1 are affected. No public proof-of-concept is known, the issue is not listed in CISA KEV, and there is no confirmed exploitation to date.

What to do: Upgrade to Nuclei 3.11.1 or later, which adds content checksums to the signature verification cache. Restrict write permissions on the templates directory, and audit it for templates whose contents do not match their signature or whose modification timestamps appear artificially preserved (e.g., via timestamp-restoring copies or touch). Users who cannot upgrade immediately should re-download templates from the official repository before running scans.