{"record":{"id":"604375af8bfc25c8","repo":"crowdsecurity/crowdsec","slug":"errnucleitemplatefail","errorCode":"ErrNucleiTemplateFail","errorMessage":"nuclei template failed","messagePattern":"nuclei template failed","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/hubtest/nucleirunner.go","lineNumber":22,"sourceCode":"\t\"bytes\"\n\t\"context\"\n\t\"errors\"\n\t\"fmt\"\n\t\"os\"\n\t\"os/exec\"\n\t\"time\"\n\n\tlog \"github.com/sirupsen/logrus\"\n)\n\ntype NucleiConfig struct {\n\tPath           string   `yaml:\"nuclei_path\"`\n\tOutputDir      string   `yaml:\"output_dir\"`\n\tCmdLineOptions []string `yaml:\"cmdline_options\"`\n}\n\nvar (\n\tErrNucleiTemplateFail = errors.New(\"nuclei template failed\")\n\tErrNucleiRunFail = errors.New(\"nuclei run failed\")\n)\n\nfunc (nc *NucleiConfig) RunNucleiTemplate(ctx context.Context, testName string, templatePath string, target string) error {\n\ttstamp := time.Now().Unix()\n\n\toutputPrefix := fmt.Sprintf(\"%s/%s-%d\", nc.OutputDir, testName, tstamp)\n\t// CVE-2023-34362_CVE-2023-34362-1702562399_stderr.txt\n\targs := []string{\n\t\t// removing the banner with --silent also removes useful [WRN] lines, so it is what it is\n\t\t// \"-silent\",\n\t\t\"-u\", target,\n\t\t\"-t\", templatePath,\n\t\t\"-o\", outputPrefix + \".json\",\n\t}\n\targs = append(args, nc.CmdLineOptions...)\n\tcmd := exec.CommandContext(ctx, nc.Path, args...)\n","sourceCodeStart":4,"sourceCodeEnd":40,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/hubtest/nucleirunner.go#L4-L40","documentation":"ErrNucleiTemplateFail in pkg/hubtest/nucleirunner.go is returned by RunNucleiTemplate/RunWithNucleiTemplate when the nuclei scan produced no stdout — meaning the template did not detect the (intentionally vulnerable) target, so the appsec test failed. Callers distinguish expected failures via Config.ExpectedNucleiFailure.","triggerScenarios":"Running a hub appsec test where nuclei runs the template against the local appsec component and outputs nothing: rules didn't block, target not reachable, or template mismatched the payload.","commonSituations":"Appsec rule collection failing its own hub tests after rule edits; wrong nuclei binary version or cmdline_options; appsec engine not running on the expected target URL.","solutions":["Check the appsec rule actually matches the test payload (run the test manually with nuclei -t <template> -u <target>)","Verify the appsec engine is up and listening on the configured target","Set expected_nuclei_failure in the test config if the failure is intended, or fix the rule/template"],"exampleFix":"// before\ntests:\n  - name: mytest\n    # rule doesn't match, test fails\n// after\n# fix the rule or mark it:\n#   expected_nuclei_failure: true","handlingStrategy":"try-catch","validationCode":"// pre-check: ensure the appsec target answers before running nuclei\ntarget := nc.Target\nif target == \"\" { return errors.New(\"no nuclei target configured\") }","typeGuard":null,"tryCatchPattern":"err := nc.RunNucleiTemplate(ctx, testName, tplPath, target)\nif errors.Is(err, ErrNucleiTemplateFail) {\n    if t.Config.ExpectedNucleiFailure { t.Success = true } else { return fmt.Errorf(\"test %s: %w\", testName, err) }\n}","preventionTips":["Manually run nuclei with the template against the target to debug silent scans","Confirm the appsec engine is running and reachable on the target URL","Pin a known nuclei version in test config to avoid behavior drift","Mark intentionally failing tests with expected_nuclei_failure"],"tags":["go","nuclei","appsec","testing"],"backgroundTag":"nuclei-template-failure","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}