Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require() function, bypassing the default local file access restriction. This issue has been patched in version 3.8.0.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d36ca2dd19 advisory.

    Update to 3.11.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3a8abe43fb advisory.

    Update to 3.11.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version
    3.8.0, a vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local
    .js and .json files through the require() function, bypassing the default local file access restriction.
    This issue has been patched in version 3.8.0. (CVE-2026-41646)

ID	Name	Product	Family	Severity
328927	Fedora 43 : nuclei (2026-d36ca2dd19)	Nessus	Fedora Local Security Checks	medium
328869	Fedora 44 : nuclei (2026-3a8abe43fb)	Nessus	Fedora Local Security Checks	medium
440748	SCA: security update for github.com/projectdiscovery/nuclei/v3 (GHSA-29rg-wmcw-hpf4)	Tenable Cloud Security	SCA Checks	medium
440748	SCA: security update for github.com/projectdiscovery/nuclei/v3 (GHSA-29rg-wmcw-hpf4)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-41646

medium

Tenable Plugins

medium

medium

medium

medium