The flaw occurs in Nuclei’s DAST/fuzz payload engine where runtime data from an internal extractor can be evaluated twice, allowing response content to be reinterpreted as template syntax. When the -env-vars option is active, a malicious target can return marker‐shaped content that resolves against the scanner’s environment variable map, exposing credentials, API keys, or other secrets stored on the scanner host.

Nuclei, a vulnerability scanner by projectdiscovery, is affected in versions 3.0.0 through 3.10.0. The vulnerability is fixed starting with release 3.10.0.

The CVSS score of 5.3 indicates a moderate severity. Because the EPSS score is not available and the issue is not listed in CISA KEV, the likelihood of widespread exploitation today is low, but the impact is significant if the attack conditions are met. The attack requires a multi‑step DAST or fuzz template, the reuse of response data via an internal extractor, and explicit environment‑variable expansion with -env-vars enabled. A malicious target can craft response data that maps to scanner environment variables, leading to disclosure of sensitive information. Users who run scans without enabling -env-vars are not affected.