v3.11.0
2026-07-10T08:51:38Z•49b6c6f7c94272d10ef8ae708e43d8435c1b8a4d99a6025ae0bad45a986feabf
CVE-2026-41646DASTGHSAallow-local-file-accessjavascript-protocolnucleiprojectdiscoverysecurity-hardeningsupply-chaintemplate-signingtemplates
What happened
ProjectDiscovery Nuclei releases (v3.6.2→v3.11.0) include multiple security hardening changes: v3.11.0 introduces a breaking change that requires custom templates using the javascript: protocol to be digitally signed (unsigned JS templates are skipped), aligning JS templates with existing code-protocol protections. Recent releases (v3.10.0, v3.8.0) implemented centralized opt-in gating, validation of code-template signatures before DAST loading, gating of allowAllFiles/local-file-access features, and fixes addressing local file access and other JS-related attack surfaces. Impact: users must re
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- projectdiscovery_nuclei_releases
- Record identifier
- 49b6c6f7c94272d10ef8ae708e43d8435c1b8a4d99a6025ae0bad45a986feabf
- Enrichment time
- 2026-07-10T08:51:38Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.