Nuclei flaw lets malicious templates bypass signature verification

A signature verification bypass (CVE-2024-43405) in the Nuclei scanner permits attackers to inject malicious code into signed YAML templates by exploiting newline interpretation differences between Go’s regex check and the YAML parser and by adding extra "# digest:" lines; ProjectDiscovery released a fix in Nuclei v3.3.2 and users are advised to update and run Nuclei in isolated environments.