A recently patched high-severity vulnerability in ProjectDiscovery’s popular open-source vulnerability scanner, Nuclei, allowed attackers to bypass template signature verification and execute arbitrary code by injecting malicious templates. The flaw, tracked as CVE-2024-43405 (CVSS score of 7.4 to 7.8), impacted Nuclei versions between 3.0.0 and 3.3.1. The issue stemmed from inconsistencies in how Go’s regex-based signature verification and the YAML parser handle newline characters. Specifically, Go’s logic treated “\r” as part of the same line, whereas the YAML parser interpreted it as a line break, enabling attackers to insert additional “# digest:” lines containing unverified malicious content that bypassed signature checks but was executed when processed by the YAML parser. Additionally, Nuclei’s verification process only checked the first “# digest:” line in a template, ignoring subsequent ones, which could be exploited to inject malicious payloads. Discovered by Wiz researchers, the vulnerability posed a significant risk when organizations ran untrusted or community-contributed templates or used automated scanning platforms that allowed user-generated templates. This could lead to arbitrary command execution, data exfiltration, or system compromise. Following responsible disclosure on August 14, 2024, ProjectDiscovery released a fix in version 3.3.2 on September 4, 2024. CTIX analysts strongly advise users to update to the latest version and run Nuclei in isolated or sandboxed environments to mitigate the risk of executing untrusted templates.