crowdsecurity/crowdsec · error

ErrNucleiTemplateFail

ErrNucleiTemplateFail

Error message

nuclei template failed

What it means

ErrNucleiTemplateFail in pkg/hubtest/nucleirunner.go is returned by RunNucleiTemplate/RunWithNucleiTemplate when the nuclei scan produced no stdout — meaning the template did not detect the (intentionally vulnerable) target, so the appsec test failed. Callers distinguish expected failures via Config.ExpectedNucleiFailure.

Solutions

1. Check the appsec rule actually matches the test payload (run the test manually with nuclei -t <template> -u <target>)
2. Verify the appsec engine is up and listening on the configured target
3. Set expected_nuclei_failure in the test config if the failure is intended, or fix the rule/template

Example fix

// before
tests:
  - name: mytest
    # rule doesn't match, test fails
// after
# fix the rule or mark it:
#   expected_nuclei_failure: true

// pre-check: ensure the appsec target answers before running nuclei
target := nc.Target
if target == "" { return errors.New("no nuclei target configured") }

err := nc.RunNucleiTemplate(ctx, testName, tplPath, target)
if errors.Is(err, ErrNucleiTemplateFail) {
    if t.Config.ExpectedNucleiFailure { t.Success = true } else { return fmt.Errorf("test %s: %w", testName, err) }
}

When it happens

Trigger: Running a hub appsec test where nuclei runs the template against the local appsec component and outputs nothing: rules didn't block, target not reachable, or template mismatched the payload.

Common situations: Appsec rule collection failing its own hub tests after rule edits; wrong nuclei binary version or cmdline_options; appsec engine not running on the expected target URL.

Related errors

• no appsec rules in hub index
• ErrNucleiRunFail
• no parsers in hub index
• no scenarios in hub index
• source is nil or not an IP

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/604375af8bfc25c8. Report an issue: GitHub.

Appendix: source

Thrown at pkg/hubtest/nucleirunner.go:22

	"bytes"
	"context"
	"errors"
	"fmt"
	"os"
	"os/exec"
	"time"

	log "github.com/sirupsen/logrus"
)

type NucleiConfig struct {
	Path           string   `yaml:"nuclei_path"`
	OutputDir      string   `yaml:"output_dir"`
	CmdLineOptions []string `yaml:"cmdline_options"`
}

var (
	ErrNucleiTemplateFail = errors.New("nuclei template failed")
	ErrNucleiRunFail = errors.New("nuclei run failed")
)

func (nc *NucleiConfig) RunNucleiTemplate(ctx context.Context, testName string, templatePath string, target string) error {
	tstamp := time.Now().Unix()

	outputPrefix := fmt.Sprintf("%s/%s-%d", nc.OutputDir, testName, tstamp)
	// CVE-2023-34362_CVE-2023-34362-1702562399_stderr.txt
	args := []string{
		// removing the banner with --silent also removes useful [WRN] lines, so it is what it is
		// "-silent",
		"-u", target,
		"-t", templatePath,
		"-o", outputPrefix + ".json",
	}
	args = append(args, nc.CmdLineOptions...)
	cmd := exec.CommandContext(ctx, nc.Path, args...)

View on GitHub (pinned to 909b515798)