https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 22:12:37 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-76819 <p>Rejected reason: Further research determined the issue results from a dependency.</p> <p>Rejected reason: Further research determined the issue results from a dependency.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-76819 https://vulnerability.circl.lu/vuln/ghsa-vxg7-f2jj-jmqm <p><strong>Affected:</strong> Go: github.com/projectdiscovery/nuclei/v3</p> <p>A vulnerability in the Goja JavaScript engine used by Nuclei&#39;s `javascript:` protocol allows arbitrary native code execution on the scanner host when running untrusted JavaScript templates.</p> <p>**Affected Component**</p> <p>The issue is in the Goja JavaScript runtime embedded in Nuclei&#39;s JavaScript protocol (`pkg/js/`). An out-of-bounds heap write in the engine can be exploited to achieve native code execution during template evaluation.</p> <p>**Description**</p> <p>Nuclei uses the Goja engine to execute `javascript:` protocol templates. A memory safety vulnerability in Goja allows attacker-controlled JavaScript to corrupt heap memory and execute arbitrary native code on the host running Nuclei.</p> <p>Because `javascript:` templates execute without the `-code` flag and unsigned JavaScript templates run by default, a malicious template from an untrusted source can trigger code execution during a normal scan. The vulnerability could also be reached through a template&#39;s `init` section, which runs during template initialization before other security checks complete.</p> <p>&gt; [!NOTE] JavaScript templates do not require the `-code` flag and are not subject to the code-template signing requirement on affected versions. Nuclei v3.11.0 adds a separate signing requirement for JavaScript templates as additional defense in depth.</p> <p>**Affected Users**</p> <p>- **CLI users** running untrusted or third-party `javascript:` templates. - **SDK users** who integrate Nuclei into platforms where end users can supply JavaScript templ…</p> <p><strong>Affected:</strong> Go: github.com/projectdiscovery/nuclei/v3</p> <p>A vulnerability in the Goja JavaScript engine used by Nuclei&#39;s `javascript:` protocol allows arbitrary native code execution on the scanner host when running untrusted JavaScript templates.</p> <p>**Affected Component**</p> <p>The issue is in the Goja JavaScript runtime embedded in Nuclei&#39;s JavaScript protocol (`pkg/js/`). An out-of-bounds heap write in the engine can be exploited to achieve native code execution during template evaluation.</p> <p>**Description**</p> <p>Nuclei uses the Goja engine to execute `javascript:` protocol templates. A memory safety vulnerability in Goja allows attacker-controlled JavaScript to corrupt heap memory and execute arbitrary native code on the host running Nuclei.</p> <p>Because `javascript:` templates execute without the `-code` flag and unsigned JavaScript templates run by default, a malicious template from an untrusted source can trigger code execution during a normal scan. The vulnerability could also be reached through a template&#39;s `init` section, which runs during template initialization before other security checks complete.</p> <p>&gt; [!NOTE] JavaScript templates do not require the `-code` flag and are not subject to the code-template signing requirement on affected versions. Nuclei v3.11.0 adds a separate signing requirement for JavaScript templates as additional defense in depth.</p> <p>**Affected Users**</p> <p>- **CLI users** running untrusted or third-party `javascript:` templates. - **SDK users** who integrate Nuclei into platforms where end users can supply JavaScript templ…</p> https://vulnerability.circl.lu/vuln/ghsa-vxg7-f2jj-jmqm