crowdsecurity/crowdsec · error

ErrNucleiTemplateFail

ErrNucleiTemplateFail

Error message

nuclei template failed

What it means

ErrNucleiTemplateFail in pkg/hubtest/nucleirunner.go is returned by RunNucleiTemplate/RunWithNucleiTemplate when the nuclei scan produced no stdout — meaning the template did not detect the (intentionally vulnerable) target, so the appsec test failed. Callers distinguish expected failures via Config.ExpectedNucleiFailure.

Source

Thrown at pkg/hubtest/nucleirunner.go:22

	"bytes"
	"context"
	"errors"
	"fmt"
	"os"
	"os/exec"
	"time"

	log "github.com/sirupsen/logrus"
)

type NucleiConfig struct {
	Path           string   `yaml:"nuclei_path"`
	OutputDir      string   `yaml:"output_dir"`
	CmdLineOptions []string `yaml:"cmdline_options"`
}

var (
	ErrNucleiTemplateFail = errors.New("nuclei template failed")
	ErrNucleiRunFail = errors.New("nuclei run failed")
)

func (nc *NucleiConfig) RunNucleiTemplate(ctx context.Context, testName string, templatePath string, target string) error {
	tstamp := time.Now().Unix()

	outputPrefix := fmt.Sprintf("%s/%s-%d", nc.OutputDir, testName, tstamp)
	// CVE-2023-34362_CVE-2023-34362-1702562399_stderr.txt
	args := []string{
		// removing the banner with --silent also removes useful [WRN] lines, so it is what it is
		// "-silent",
		"-u", target,
		"-t", templatePath,
		"-o", outputPrefix + ".json",
	}
	args = append(args, nc.CmdLineOptions...)
	cmd := exec.CommandContext(ctx, nc.Path, args...)

View on GitHub (pinned to 909b515798)

Solutions

1. Check the appsec rule actually matches the test payload (run the test manually with nuclei -t <template> -u <target>)
2. Verify the appsec engine is up and listening on the configured target
3. Set expected_nuclei_failure in the test config if the failure is intended, or fix the rule/template

Example fix

// before
tests:
  - name: mytest
    # rule doesn't match, test fails
// after
# fix the rule or mark it:
#   expected_nuclei_failure: true

// pre-check: ensure the appsec target answers before running nuclei
target := nc.Target
if target == "" { return errors.New("no nuclei target configured") }

err := nc.RunNucleiTemplate(ctx, testName, tplPath, target)
if errors.Is(err, ErrNucleiTemplateFail) {
    if t.Config.ExpectedNucleiFailure { t.Success = true } else { return fmt.Errorf("test %s: %w", testName, err) }
}

When it happens

Trigger: Running a hub appsec test where nuclei runs the template against the local appsec component and outputs nothing: rules didn't block, target not reachable, or template mismatched the payload.

Common situations: Appsec rule collection failing its own hub tests after rule edits; wrong nuclei binary version or cmdline_options; appsec engine not running on the expected target URL.

Related errors

• no appsec rules in hub index
• source is nil or not an IP
• no parsers in hub index
• no scenarios in hub index
• ErrNucleiRunFail

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/604375af8bfc25c8. Report an issue: GitHub.