A flaw in the JavaScript protocol runtime of the Nuclei vulnerability scanner allows JavaScript templates to read local .js and .json files via the require() function, bypassing its intended file access restrictions. This local file read can expose sensitive configuration, credential, or source code files that are available on the host where Nuclei runs, potentially leaking confidential information to an attacker who can influence template execution.

The vulnerability affects projectdiscovery's Nuclei scanner versions from 3.0.0 up to, but not including, 3.8.0. All installations of those releases that rely on the JavaScript protocol runtime are susceptible when templates use require() to load local data files.

The CVSS score of 5.5 indicates moderate risk, and the vulnerability is not listed in the CISA KEV catalog. The EPSS metric is not available, so the current probability of exploitation cannot be quantified. Based on the description, the attack vector is likely local; an attacker would need to supply or modify a template that runs under the scanner to trigger the file read. While the impact is limited to the scanner's host, exposure of local files can still be significant if the scanner operates in a privileged or otherwise sensitive environment.