crowdsecurity/crowdsec · error · ErrNucleiRunFail

%w: %v

Error message

%w: %v

What it means

RunNucleiTemplate executes the nuclei binary against a template and, when the underlying command exits with an error, wraps the sentinel ErrNucleiRunFail with the command's error output. It tells the hubtest user that the nuclei scan itself failed (bad binary, bad template, bad target), not that assertion logic failed. Check the saved _stdout.txt/_stderr.txt files printed just before the error for the real cause.

Source

Thrown at pkg/hubtest/nucleirunner.go:71

		log.Errorf("Error writing stdout: %s", err)
	}

	errBytes := outErr.Bytes()

	if err := os.WriteFile(outputPrefix+"_stderr.txt", errBytes, 0o644); err != nil {
		log.Errorf("Error writing stderr: %s", err)
	}

	if cmdErr != nil {
		// display stderr in addition to writing to a file
		os.Stdout.Write(errBytes)
		os.Stdout.WriteString("\n")

		fmt.Fprintln(os.Stdout, "Stdout saved to", outputPrefix+"_stdout.txt")
		fmt.Fprintln(os.Stdout, "Stderr saved to", outputPrefix+"_stderr.txt")
		fmt.Fprintln(os.Stdout, "Nuclei generated output saved to", outputPrefix+".json")

		return fmt.Errorf("%w: %v", ErrNucleiRunFail, cmdErr)
	}

	if out.String() == "" {
		fmt.Fprintln(os.Stdout, "Stdout saved to", outputPrefix+"_stdout.txt")
		fmt.Fprintln(os.Stdout, "Stderr saved to", outputPrefix+"_stderr.txt")
		fmt.Fprintln(os.Stdout, "Nuclei generated output saved to", outputPrefix+".json")

		// No stdout means no finding, it means our test failed
		return ErrNucleiTemplateFail
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

  1. Run `nuclei -version` (or run the nuclei command manually with the same args) to confirm the binary works and inspect the stderr file saved next to the output prefix.
  2. Install/upgrade nuclei and ensure it is on PATH for the test process.
  3. Validate the template with `nuclei -t <template> -validate` and fix syntax/deprecated fields.
  4. Confirm the target URL/service in the test config is reachable before running hubtest.

Example fix

// before (no check)
err := hubtest.RunWithNucleiTemplate(ctx, tpl, target)
// after
if _, err := exec.LookPath("nuclei"); err != nil {
	return fmt.Errorf("nuclei binary not found in PATH: %w", err)
}
if err := hubtest.RunWithNucleiTemplate(ctx, tpl, target); err != nil {
	if !errors.Is(err, hubtest.ErrNucleiRunFail) {
		return err
	}
	log.Printf("nuclei run failed, see *_stderr.txt: %v", err)
}
Defensive patterns

Strategy: try-catch

Validate before calling

if _, err := exec.LookPath("nuclei"); err != nil {
	return fmt.Errorf("nuclei not installed/on PATH: %w", err)
}
if err := os.MkdirAll(filepath.Dir(outputPrefix), 0o755); err != nil {
	return err
}

Try / catch

err := hubtest.RunWithNucleiTemplate(ctx, tpl, target)
if errors.Is(err, hubtest.ErrNucleiRunFail) {
	// inspect outputPrefix+"_stderr.txt" for the nuclei-level cause
	log.Printf("nuclei run failed: %v", err)
	return err
}
if err != nil {
	return err
}

Prevention

When it happens

Trigger: Calling RunWithNucleiTemplate/RunNucleiTemplate with a template whose nuclei invocation exits non-zero: nuclei not installed or wrong PATH, malformed template YAML, unreachable target URL, or invalid nuclei flags.

Common situations: CI runner without nuclei in PATH; template referencing an outdated nuclei syntax after a nuclei upgrade; target service not running during test; output prefix directory not writable.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/e92c7b6d08624aa3. Report an issue: GitHub.