CVE-2026-41282

CVE-2026-41282 is a DSL expression injection vulnerability affecting ProjectDiscovery Nuclei versions before 3.8.0, a widely-used security scanning framework. The flaw specifically impacts users who deploy the -env-vars parameter with multi-step templates when scanning untrusted targets, deviating from typical default configurations. An unauthenticated attacker with network access can exploit this vulnerability to inject malicious expressions and achieve high-severity confidentiality breaches without requiring user interaction or elevated privileges. While the CVSS score of 7.5 indicates a high-severity vulnerability with low attack complexity, the EPSS score of 0.00044 suggests relatively low real-world exploitation probability compared to other disclosed CVEs. The vulnerability is currently marked as active on threat tracking lists and warrants prompt patching to version 3.8.0 or later, particularly for organizations conducting security assessments against external or untrusted targets.