v3.8.0

2026-04-18T08:51:43Z•2465c3efe4a4a40f00ded3a31f2dcdac13a4db23129699c9da46b7ad6f249b66

GHSAallow-local-file-accessarbitrary-code-executionjavascriptnucleiprojectdiscoveryreleasesecurity-fixtemplate-expressions

Open source link →

What happened

ProjectDiscovery Nuclei v3.8.0 (release) includes security fixes: a JavaScript fix to respect the allow-local-file-access setting in require (mitigating unintended local file access) and a hardening to only evaluate expressions authored in templates (reducing risk of arbitrary expression/code execution via templates). The release references GitHub Security Advisory GHSA-29rg-wmcw-hpf4 for the local-file-access issue.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID: projectdiscovery_nuclei_releases
Record identifier: 2465c3efe4a4a40f00ded3a31f2dcdac13a4db23129699c9da46b7ad6f249b66
Enrichment time: 2026-04-18T08:51:43Z
AI-assisted enrichment: Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

← Back to published records