CVE-2026-76803: Nuclei MySQL Client Local File Read Vulnerability
Summary
CVE-2026-76803: Nuclei: Local File Read via MySQL Client Sandbox Bypass. Affects github.com/projectdiscovery/nuclei/v3 versions >= 3.0.0, < 3.10.0. Fixed in 3.10.0. How to fix ↓
Also tracked for
The same CVE-2026-76803 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nuclei is an open-source tool designed for fast and customizable vulnerability scanning. It utilizes templates to define various scanning techniques, including those for MySQL databases. The tool's JavaScript MySQL client library is integral for executing queries against MySQL-compatible databases. However, a flaw in this library allows for local file access that bypasses intended security restrictions, posing a risk to users who run untrusted templates.
Vulnerability Detail
A vulnerability exists in the Nuclei JavaScript MySQL client library that permits arbitrary local file reads by bypassing the '-allow-local-file-access' (lfa) sandbox restriction. This issue arises when the 'allowAllFiles' DSN parameter is used in conjunction with the 'LOAD DATA LOCAL INFILE' command. Attackers can exploit this by connecting to a malicious MySQL server that issues requests for arbitrary file paths on the scanner host, effectively reading sensitive files and sending their contents to the server. This vulnerability is particularly concerning for users running untrusted or third-party JavaScript templates against MySQL endpoints.
How To Fix
Latest published version: v3.11.1 as of 22 Oct 2026
go get github.com/projectdiscovery/nuclei/v3@v3.11.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.10.0
This is the first release that contains the fix.
go get github.com/projectdiscovery/nuclei/v3@v3.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not feasible, users should avoid running untrusted JavaScript templates, especially against untrusted database endpoints. There is no configuration option available to mitigate this bypass in affected versions.
Conclusion
The Nuclei vulnerability CVE-2026-76803 poses a significant risk by allowing local file reads through a bypass of the local file access restrictions. Users are strongly encouraged to upgrade to version 3.10.0 or later to mitigate this risk. In the interim, caution should be exercised when running untrusted templates.
See every vulnerability recorded for github.com/projectdiscovery/nuclei/v3 →
FAQ
The vulnerability allows arbitrary local file reads by bypassing the local file access restrictions in the Nuclei MySQL client library.
CLI users running untrusted JavaScript templates against MySQL-compatible targets and SDK users integrating Nuclei into platforms where users can supply JavaScript templates are affected.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
If immediate upgrading is not an option, refrain from running untrusted JavaScript templates and avoid connecting to untrusted MySQL endpoints.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/projectdiscovery/nuclei/v3.
