Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
projectdiscovery/nuclei
dev @ 9c47e6c
37
Fixes
6
CVEs
HIGH
Peak severity
Highlights
Path Traversal: 10 prior fixes. Scrutinize any change in this area.
pkg/catalog/loader/loader.go: most-fixed (3 issues). Treat as high-risk during review.
21 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Remote Code Execution: Code-execution templates can execute arbitrary command payloads on the scanner host if signature checks are bypassed or if privileged execution flags are not evaluated directly at the sink level. Ensuring mandatory cryptographic verification and proper check delegation within ExecuteWithResults is critical.
Path Traversal: The JavaScript compiler and runtime must strictly canonicalize import paths and restrict require() statements to prevent arbitrary local file reads. Insufficient sandboxing of local modules allows malicious templates to escape boundaries.
Expression Language Injection: Processing dynamic or untrusted target response payloads within multi-step template operations can result in expression injection if dynamic placeholders are re-evaluated recursively as DSL expressions.