{"record":{"id":"aa3283a6b7c6b9ce","repo":"projectdiscovery/nuclei","slug":"invalid-goexec-method-arguments-w","errorCode":null,"errorMessage":"invalid goexec method arguments: %w","messagePattern":"invalid goexec method arguments: %w","errorType":"validation","errorClass":"ErrInvalidMethodArguments","httpStatus":null,"severity":"error","filePath":"pkg/js/libs/goexec/adapter_goexec.go","lineNumber":112,"sourceCode":"\t\t\t\tClient:   client,\n\t\t\t\tResource: \"//./root/cimv2\",\n\t\t\t},\n\t\t\tWorkingDirectory: req.Options.Directory,\n\t\t}\n\t\tif err := upstream.ExecuteCleanMethod(ctx, module, execIO); err != nil {\n\t\t\treturn err\n\t\t}\n\t\tcollectExecutionOutput(req, result, execIO)\n\t\treturn nil\n\tcase \"call\":\n\t\tclient, err := r.dceClient(ctx, req, \"cifs\", \"\")\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\targs := map[string]any{}\n\t\tif req.MethodArgsJSON != \"\" {\n\t\t\tif err := json.Unmarshal([]byte(req.MethodArgsJSON), &args); err != nil {\n\t\t\t\treturn fmt.Errorf(\"%w: %w\", ErrInvalidMethodArguments, err)\n\t\t\t}\n\t\t}\n\t\tvar out bytes.Buffer\n\t\tmodule := &gowmi.WmiCall{\n\t\t\tWmi: gowmi.Wmi{\n\t\t\t\tClient:   client,\n\t\t\t\tResource: defaultString(req.Namespace, \"//./root/cimv2\"),\n\t\t\t},\n\t\t\tClass:  req.ClassName,\n\t\t\tMethod: req.MethodName,\n\t\t\tArgs:   args,\n\t\t\tOut:    &out,\n\t\t}\n\t\tif module.Class == \"\" || module.Method == \"\" {\n\t\t\treturn ErrInvalidMethodArguments\n\t\t}\n\t\tif err := upstream.ExecuteCleanAuxiliaryMethod(ctx, module); err != nil {\n\t\t\treturn err","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/goexec/adapter_goexec.go#L94-L130","documentation":"The goexec WMI 'call' path failed to json.Unmarshal Request.MethodArgsJSON into a map, wrapping ErrInvalidMethodArguments. The 4th argument of wmi.Client.Call(namespace, className, method, argsJSON) must be a strict JSON object string; JS-style object text (single quotes, unquoted keys, trailing commas) or a JSON array/scalar string is rejected. Note the failure lands in the structured result (res.ok=false, res.error='invalid goexec method arguments: ...') rather than a thrown JS exception.","triggerScenarios":"wmi.Call('root\\\\cimv2', 'Win32_Process', 'Create', \"{'CommandLine':'cmd /c whoami'}\") — single quotes/unquoted keys; also a JSON array string '[1,2]' or scalar '\"x\"' instead of an object. Triggered only for non-empty strings; '' skips the unmarshal.","commonSituations":"Template authors hand-writing JS object literals as strings; passing values built by string concatenation; forgetting the argument is JSON, not JS.","solutions":["Pass strict JSON: '{\"Name\":\"value\"}' with double quotes and no trailing commas.","Build the string in JS: JSON.stringify({Name: 'value'}).","Use '' (empty string) for no-arg methods.","Always inspect res.ok / res.error on goexec-backed calls — this error does not throw."],"exampleFix":"// before\nconst res = wmiClient.Call('root\\\\cimv2', 'Win32_Process', 'Create', \"{'CommandLine':'cmd /c whoami'}\"); // res.ok=false, invalid goexec method arguments\n\n// after\nconst args = JSON.stringify({CommandLine: 'cmd /c whoami'});\nconst res = wmiClient.Call('root\\\\cimv2', 'Win32_Process', 'Create', args);\nif (!res.ok) log('wmi call failed: ' + res.error);","handlingStrategy":"validation","validationCode":"// strict-JSON object check before calling wmi.Client.Call\nfunction isJsonObjectString(s) {\n  if (typeof s !== 'string' || s.trim() === '') return s === ''; // '' = no args, allowed\n  try {\n    const v = JSON.parse(s);\n    return v !== null && typeof v === 'object' && !Array.isArray(v);\n  } catch (_) { return false; }\n}\nif (!isJsonObjectString(argsJSON)) {\n  throw new Error('argsJSON must be strict JSON like {\\\"Name\\\":\\\"value\\\"}, got: ' + argsJSON);\n}","typeGuard":"/** @param {unknown} s @returns {boolean} */\nfunction isStrictJsonObjectString(s) {\n  if (typeof s !== 'string' || s === '') return s === '';\n  try {\n    const v = JSON.parse(s);\n    return !!v && typeof v === 'object' && !Array.isArray(v);\n  } catch (_) { return false; }\n}","tryCatchPattern":"const res = wmiClient.Call(ns, cls, method, argsJSON);\nif (!res.ok && String(res.error).includes('invalid goexec method arguments')) {\n  // malformed JSON args: rebuild with JSON.stringify and retry once\n  const fixed = JSON.stringify(JSON.parse(JSON.stringify(args)));\n}","preventionTips":["Never hand-write JSON strings; build them with JSON.stringify({...}).","Use '' for no-argument method calls.","Check res.ok / res.error on every goexec-backed call — these errors do not throw."],"tags":["json","validation","wmi","goexec","javascript"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}