The vulnerability in ProjectDiscovery Nuclei 3 versions before 3.8.0 permits an attacker to inject arbitrary expressions into the tool’s Domain Specific Language (DSL). When the -env-vars option is used with multi‑step templates that reference untrusted targets, the injected expression can be evaluated, potentially leading to unintended execution of code or other malicious effects. This flaw is classified as a CWE‑94 expression injection.

The flaw impacts all deployments of ProjectDiscovery Nuclei initialized with the -env-vars flag for any multi‑step template. Versions 3.0 through 3.7.9 are affected, while 3.8.0 and later contain a fix. The issue is not limited by default configuration and arises only when templates target untrusted services.

The CVSS score of 4 indicates a low to moderate severity, and the lack of an EPSS listing suggests a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a malicious template and configure the -env-vars setting against an untrusted target; therefore the risk is most relevant to users who run custom Nuclei jobs from untrusted sources. Prompt patching reduces the risk surface significantly.