Nuclei (< 3.11.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/nuclei--3.11.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 16 Sep 2026 19:52:07 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgNuclei Template Signature Verification Bypasshttps://feed.craftedsignal.io/briefs/2026-09-nuclei-template-bypass/Wed, 16 Sep 2026 19:52:07 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-nuclei-template-bypass/Nuclei versions before 3.11.1 are vulnerable to template signature bypass due to reliance on file modification timestamps for cache validation, allowing attackers to inject malicious templates.Nuclei versions prior to 3.11.1 contain a critical flaw in the template signature verification process. The application attempts to optimize performance by caching the results of signature verification based solely on the file modification timestamp (mtime) of the template rather than utilizing cryptographic checksums. An attacker who has gained local access to the system can replace a legitimate, previously verified template with an unsigned, malicious variant. By restoring the original modification timestamp of the file, the attacker forces the Nuclei engine to treat the malicious content as validly signed. When Nuclei executes the tampered template, it may perform unauthorized actions, including the execution of arbitrary operating system commands, depending on the capabilities defined in the malicious template. This vulnerability is particularly impactful in automated pipeline environments where Nuclei is trusted to perform security scans.

Attack Chain

  1. Attacker gains unauthorized file system access to the directory containing Nuclei templates.
  2. Attacker identifies a legitimate template that has already been verified and cached by Nuclei.
  3. Attacker modifies the template file to include malicious instructions or payloads capable of OS command execution.
  4. Attacker updates the file modification timestamp of the malicious template to match the original timestamp of the legitimate file.
  5. Attacker triggers a scan or waits for the next scheduled execution of the Nuclei scanner.
  6. Nuclei performs a cache lookup, confirms the modification time matches the cached state, and skips re-verification.
  7. The Nuclei engine executes the tampered template as a trusted entity.
  8. Final objective is achieved: arbitrary code execution on the host running the Nuclei scanner.

Impact

Successful exploitation allows for arbitrary command execution under the privileges of the Nuclei process. This represents a significant risk for organizations relying on Nuclei in CI/CD pipelines, automated security orchestration, or local security tooling. If exploited, an attacker could escalate local access to full system control or pivot further into the internal network from the scanning host.

Recommendation

  1. Upgrade all instances of Nuclei to version 3.11.1 or later to implement secure cryptographic template verification.
  2. Implement file integrity monitoring (FIM) on directories storing Nuclei templates to alert on unexpected file modifications.
  3. Restrict file system permissions for the directory containing Nuclei templates, ensuring only the service account running the scanner has write access.
  4. Conduct an audit of existing templates to identify unauthorized modifications.
]]>highadvisory