v3.9.0
2026-06-11T08:51:40Z•7cc4b8964eab10559bb78eed1cfd71cd89dcc90695197c418f23ec804be9f3fa
CVE-2026-41646GHSA-29rg-wmcw-hpf4cdp-endpointdcomheadlessimpacketjavascriptlocal-file-accessnucleiprojectdiscoveryprotocol-redirectsreleasersyncsandboxscmrsecurity-fixtemplate-injectiontls-session-cachingwmi
What happened
ProjectDiscovery Nuclei release notes (v3.6.0 through v3.9.0) detailing new features, bug fixes and important security fixes. Notable items: v3.8.0 fixes a JS sandbox/local-file-access vulnerability (CVE-2026-41646 / GHSA-29rg-wmcw-hpf4) by respecting allow-local-file-access in require; template evaluation was tightened to only evaluate template-authored expressions to mitigate injection risks. v3.9.0 and other releases add features including protocol redirect support, impacket integration, new JS helper modules (wmi, tsch, scmr, dcom), headless/CDP endpoint options, RSYNC module, TLS session‑
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- projectdiscovery_nuclei_releases
- Record identifier
- 7cc4b8964eab10559bb78eed1cfd71cd89dcc90695197c418f23ec804be9f3fa
- Enrichment time
- 2026-06-11T08:51:40Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.