Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability description clearly states that the issue lies in 'Nuclei's workflow template loader' which 'did not apply the same check when resolving templates referenced by a workflow' for file: protocol templates. The provided commit 638be4481d27f1bbf90f971bbf6e3023777f2089 and its associated pull request https://github.com/projectdiscovery/nuclei/pull/7489 directly address this by refactoring template capability checks.
Upon examining the diff for pkg/templates/workflows.go, the parseWorkflowTemplate function is the key component of the workflow loader. Before the patch, this function contained specific, limited checks (e.g., for code templates) but lacked a general mechanism to enforce all template capabilities, including the CapabilityFile (which corresponds to the -file flag). The patch introduces a new Capability system and replaces the ad-hoc checks with a unified template.MissingLoadCapabilities(caps) call. This new call correctly identifies and prevents the loading of templates that require specific capabilities (like file: protocol access) if those capabilities are not explicitly enabled in the Nuclei options. Therefore, the parseWorkflowTemplate function, in its state before this patch, was vulnerable due to its incomplete enforcement of security-critical template loading requirements.
parseWorkflowTemplatepkg/templates/workflows.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/projectdiscovery/nuclei/v3 | go | >= 3.0.0, < 3.10.0 | 3.10.0 |