The flaw lies in Nuclei’s expression evaluation engine, which processes HTTP response data containing helper function syntax when multi‑step templates are used. A malicious server can embed a supported DSL expression within the response, causing the scanner to evaluate and execute that expression. This can lead to runtime code execution inside Nuclei and, if the -env-vars (-ev) option is enabled, the disclosure of the host machine’s environment variables. The impact is therefore both information disclosure and potential manipulation of the scanning environment.

ProjectDiscovery Nuclei vulnerability scanner, versions 3.0.0 through 3.7.x. The issue is fixed in 3.8.0. The vulnerability occurs only when the –env‑vars or –ev option is enabled, which is off by default; however, the code execution path exists regardless of that flag.

CVSS score 5.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no current widespread exploitation. The attack vector requires an attacker to control the target server and craft a response that includes a malicious DSL expression that Nuclei will process while scanning. Because the attack depends on a specific scanning configuration and a controlled response, the likelihood of exploitation is moderate but not negligible.