Nuclei, a vulnerability scanner that uses a YAML-based DSL, had a flaw in its DAST template loading branch. When the -dast flag is enabled, the scanner accepted templates that combined a fuzzing block with an unsigned code block without first verifying the template’s cryptographic signature. This omission allowed an attacker to inject arbitrary shell commands through attacker‑supplied templates, resulting in full command execution on the host running the scan. The weakness originates from improper input validation, mapped to CWE‑78.

The issue affects ProjectDiscovery Nuclei vulnerability scanner versions from 3.0.0 up to, but not including, 3.10.0. Any installation of the scanner within this range that uses the CLI DAST mode or SDK integrations with DAST enabled and accepts external templates is vulnerable.

The CVSS score of 4.7 indicates a moderate severity, but the lack of an EPSS score and absence from the CISA KEV registry mean exploitation likelihood is uncertain. Nevertheless, an attacker can execute the vulnerability by providing a crafted template to a DAST-enabled run; this can be performed from the command line or via an SDK integration if the template source is not trusted. The flaw permits complete compromise of the host and could be leveraged to gain persistence or pivot to other systems.