CVE-2026-41646 — Nuclei'S JavaScript Protocol Runtime Vulnerability

title: CVE-2026-41646 - Nuclei JavaScript Protocol File Read via require()
id: scw-2026-05-08-ai-1
status: experimental
level: high
description: |
  Detects the execution of Nuclei with command lines that suggest the exploitation of CVE-2026-41646. The vulnerability allows JavaScript templates to read local .js and .json files via the require() function. This rule looks for the 'nuclei' executable being run with arguments that include file extensions commonly targeted for exfiltration or further exploitation.
author: SCW Feed Engine (AI-generated)
date: 2026-05-08
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-41646/
tags:
  - attack.discovery
  - attack.t1083
logsource:
    category: process_creation
detection:
  selection:
      Image|contains:
          - 'nuclei'
      CommandLine|contains:
          - '.js'
          - '.json'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse