Listen to this Post
CVE-2026-76819 is a critical memory safety vulnerability affecting the Goja JavaScript engine embedded within Nuclei’s `javascript:` protocol implementation. Goja is a pure Go JavaScript engine that provides an ECMAScript 5.1 compliant runtime with some ES6 features, and it is used by Nuclei to execute JavaScript templates through the `pkg/js/` package. The vulnerability originates from an out-of-bounds heap write in Goja’s implementation of the `TypedArray.prototype.with` and `TypedArray.prototype.toReversed` methods. These methods create a copy of the TypedArray data and modify the copy, but the implementation incorrectly applies the source array’s offset when writing to the newly allocated destination array. When the offset is greater than zero, the write operation indexes past the end of the destination buffer. Although Go’s built-in bounds checking would normally prevent memory corruption, Goja’s TypedArray `set` method heavily utilizes the `unsafe` package to bypass runtime checks for performance reasons. This combination of a logic error and unsafe pointer operations transforms what would be a simple crash into a controllable heap corruption primitive.
An attacker can exploit this vulnerability by crafting a malicious JavaScript template that, when evaluated by Nuclei, corrupts adjacent heap memory. Because the `javascript:` protocol templates execute without requiring the `-code` flag, and unsigned JavaScript templates run by default on affected versions, a template from an untrusted source can trigger arbitrary native code execution on the scanner host during a normal scan. The vulnerability can also be reached through a template’s `init` section, which runs during template initialization before other security checks and signature validations complete. This means that even if a template is subsequently rejected due to missing or invalid signatures, the malicious code in the `init` section may have already executed. The vulnerability affects Nuclei versions from 3.0.0 through 3.9.x, with the fix introduced in version 3.10.0 by updating the Goja dependency. Additional hardening in version 3.11.0 requires cryptographic signatures for all JavaScript templates as a defense-in-depth measure. The CVSS v3.1 base score is 8.6 (High), with a vector string of CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, reflecting local attack vector, low complexity, no privileges required, user interaction required, and high impact to confidentiality, integrity, and availability.
DailyCVE Form:
Platform: Nuclei
Version: 3.0.0–3.9.x
Vulnerability: Heap OOB Write
Severity: Critical
date: 2026-09-22
Prediction: 2026-10-15
What Undercode Say
Check Nuclei version:
nuclei -version
Check Goja dependency version:
go list -m github.com/dop251/goja
Verify if a template is signed:
nuclei -t /path/to/template.yaml -validate
Scan with untrusted template (vulnerable):
nuclei -t untrusted-template.yaml -u https://target.com
Check template signature requirement:
grep -r "javascript:" ~/nuclei-templates/ | head -20
Update Nuclei to patched version:
go install -v github.com/projectdiscovery/nuclei/v3/cmd/[email protected]
Exploit: (Educational Purposes!)
The exploitation of CVE-2026-76819 requires constructing a JavaScript payload that leverages the out-of-bounds write in TypedArray.prototype.with. The core primitive involves creating a TypedArray view with a non-zero offset, then calling `with` to trigger the write past the destination buffer boundary:
// Allocate an 8-byte buffer let buffer = new ArrayBuffer(8); // Create a view with a 4-byte offset let view = new Int32Array(buffer, 4); // Trigger out-of-bounds write via with() let corrupted = view.with(0, 0xdeadbeef);
The `with` method allocates a new TypedArray of length 1, but then writes to index `ta.offset + k` instead of k. With an offset of 4 bytes, this writes past the end of the new 4-byte allocation, corrupting adjacent heap memory. Researchers from Searchlight Cyber demonstrated that this primitive can be extended to achieve arbitrary read/write by hijacking Go function pointers associated with Date.now, ultimately leading to arbitrary code execution.
A malicious Nuclei template embedding this payload in its `init` section will execute the JavaScript before signature validation completes:
id: malicious-template
info:
name: Malicious
author: attacker
severity: critical
javascript:
- pre-condition: true
code: |
// Goja OOB write payload
let buf = new ArrayBuffer(16);
let arr = new Int32Array(buf, 8);
arr.with(0, 0x41414141);
args:
- target: "{{Host}}"
In a test environment, this type of payload achieved command execution as root, including on macOS via a ROP-based path.
Protection: from this CVE
Upgrade to Nuclei v3.10.0 or later, which fixes the vulnerability by updating the Goja dependency. For additional defense in depth, upgrade to v3.11.0 where JavaScript templates require valid cryptographic signatures before execution. Avoid running JavaScript templates from unverified or untrusted sources. There is no configuration flag that mitigates native code execution on affected versions; disabling untrusted template execution is the only workaround if upgrading is not possible. Organizations using Goja in other applications should also update to the latest patched Goja release, as the same underlying engine flaw affects any product embedding the library.
Impact:
Successful exploitation allows an attacker to execute arbitrary native code on the scanner host with the privileges of the Nuclei process. In typical deployments, this could lead to complete system compromise, data exfiltration, lateral movement within the network, and installation of persistent backdoors. The vulnerability affects both CLI users running untrusted or third-party `javascript:` templates and SDK users who integrate Nuclei into platforms where end users can supply JavaScript templates. The `init` section execution path means that even templates that would ultimately fail signature validation can still trigger code execution, making signature-based defenses alone insufficient on affected versions. The EPSS score is not yet available, but the CVSS base score of 8.6 indicates a high severity rating with scope change, meaning a successful exploit can impact resources beyond the vulnerable component’s security scope.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
