crowdsecurity/crowdsec · error

%s is tainted, use '--force' to remove

Error message

%s is tainted, use '--force' to remove

What it means

The disable command's Prepare refuses to disable a hub item that is 'tainted' (locally modified) unless --force is given. The error '%s is tainted, use --force to remove' protects local customizations from being silently discarded.

Source

Thrown at pkg/hubops/disable.go:63

type DisableCommand struct {
	Item  *cwhub.Item
	Force bool
}

func NewDisableCommand(item *cwhub.Item, force bool) *DisableCommand {
	return &DisableCommand{Item: item, Force: force}
}

func (c *DisableCommand) Prepare(plan *ActionPlan) (bool, error) {
	i := c.Item

	if i.State.IsLocal() {
		log.Warnf("%s is a local item, please delete manually", i.FQName())
		return false, nil
	}

	if i.State.Tainted && !c.Force {
		return false, fmt.Errorf("%s is tainted, use '--force' to remove", i.Name)
	}

	if !i.State.IsInstalled() {
		return false, nil
	}

	subsToRemove, err := i.SafeToRemoveDeps()
	if err != nil {
		return false, err
	}

	for _, sub := range subsToRemove {
		if !sub.State.IsInstalled() {
			continue
		}

		if err := plan.AddCommand(NewDisableCommand(sub, c.Force)); err != nil {
			return false, err

View on GitHub (pinned to 909b515798)

Solutions

1. Add --force to the disable command to discard local modifications
2. Back up the modified file first, then disable with --force and reapply changes to a local (untainted) copy
3. Use 'cscli hub list' to see which items are tainted before acting

Example fix

// before
cscli scenarios disable crowdsecurity/http-bf-generic  # tainted error
// after
cp /etc/crowdsec/scenarios/http-bf-generic.yaml ~/http-bf-generic.bak.yaml
cscli scenarios disable crowdsecurity/http-bf-generic --force

if item.State.Tainted && !force {
    return fmt.Errorf("%s is tainted; use --force or back up changes", item.FQName())
}

if err := disableCmd.Run(ctx, plan); err != nil {
    if strings.Contains(err.Error(), "is tainted") { /* prompt user to confirm --force */ }
    return err
}

When it happens

Trigger: Running 'cscli <type> disable <item>' where item.State.Tainted is true and the DisableCommand's Force flag is false.

Common situations: User edited an installed parser/scenario in place (making it tainted) and later tries to disable or upgrade it.

Understand the failure class

Background: "mutually exclusive" flag errors: what "can't supply both nx and xx", "--raw is not compatible with -i" and "cannot be used with" mean, and how to fix them — this error's family across 29 libraries.

Related errors

• %s is tainted, use '--force' to remove
• ErrUserCanceled
• while disabling %s: %w
• no appsec_config provided
• no hub configuration provided

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ed00e4131b21317a. Report an issue: GitHub.