Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the Goja JavaScript runtime embedded in the javascript: protocol under pkg/js/ contains an out-of-bounds heap write that can corrupt memory during template evaluation and allow native code execution on the scanner host. A malicious untrusted JavaScript template can trigger the flaw during a normal scan, including from a template init section that runs during initialization. JavaScript templates execute without the -code flag and unsigned JavaScript templates run by default on affected versions, exposing CLI and SDK deployments that accept third-party templates. This issue is fixed in version 3.10.0.
This CVE has been withdrawn by MITRE
MITRE marked CVE-2026-76819 as REJECTED on . It is no longer considered a valid vulnerability record. The original content below is preserved for historical reference only.
Reason given by MITRE
Further research determined the issue results from a dependency.
CVE-2026-76819
✕ Withdrawn — historical dataHIGHPre-NVD 8.6
8.6CVSS
- CVSS v3
- 8.6
- EchelonGraph score
- Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
- EPSS PROB
- —
- EPSS %ILE
- —
- KEV
- —Not applicable: this CVE ID was withdrawn
Published
September 22, 2026
Last Modified
September 22, 2026
References (5)
- https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-vxg7-f2jj-jmqm
- https://github.com/projectdiscovery/nuclei/pull/7467
- https://github.com/projectdiscovery/nuclei/pull/7514
- https://github.com/projectdiscovery/nuclei/commit/1fe6025b966cbb95ed4d9f40abfb629b6cbd27b2
- https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0
Frequently asked(4)
What is CVE-2026-76819?
CVE-2026-76819 is a rejected CVE ID: its record was withdrawn on September 22, 2026 and no longer describes a vulnerability. Reason given: Further research determined the issue results from a dependency.
When was the CVE record for CVE-2026-76819 published?
The CVE record for CVE-2026-76819 was published on September 22, 2026. EchelonGraph's copy of the record carries a last-modified date of September 22, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2026-76819?
CVE-2026-76819 has a CVSS base score of 8.6 (the CNA's own assessment, by github_m; NVD's own analysis pending).
How do I remediate CVE-2026-76819?
There is nothing to remediate under CVE-2026-76819: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.