What causes "could not parse json: %s" in projectdiscovery/nuclei?

Rewrite JSONPath to jq syntax: '$.a.b[0]' becomes '.a.b[0]'

could not parse json: %s

Error message

could not parse json: %s

What it means

Template compilation error from Extractor.CompileExtractors (pkg/operators/extractors/compile.go:47). For `type: json` extractors, each `json:` entry must be a valid gojq query. gojq.Parse failing on the syntax produces this error with the offending query text.

Source

Thrown at pkg/operators/extractors/compile.go:47

		if cached, err := cache.Regex().GetIFPresent(regex); err == nil && cached != nil {
			e.regexCompiled = append(e.regexCompiled, cached)
			continue
		}
		compiled, err := regexp.Compile(regex)
		if err != nil {
			return fmt.Errorf("could not compile regex: %s", regex)
		}
		_ = cache.Regex().Set(regex, compiled)
		e.regexCompiled = append(e.regexCompiled, compiled)
	}
	for i, kval := range e.KVal {
		e.KVal[i] = strings.ToLower(kval)
	}

	for _, query := range e.JSON {
		query, err := gojq.Parse(query)
		if err != nil {
			return fmt.Errorf("could not parse json: %s", query)
		}
		compiled, err := gojq.Compile(query)
		if err != nil {
			return fmt.Errorf("could not compile json: %s", query)
		}
		e.jsonCompiled = append(e.jsonCompiled, compiled)
	}

	for _, dslExp := range e.DSL {
		if cached, err := cache.DSL().GetIFPresent(dslExp); err == nil && cached != nil {
			e.dslCompiled = append(e.dslCompiled, cached)
			continue
		}
		compiled, err := govaluate.NewEvaluableExpressionWithFunctions(dslExp, dsl.HelperFunctions)
		if err != nil {
			return &dsl.CompilationError{DslSignature: dslExp, WrappedError: err}
		}
		_ = cache.DSL().Set(dslExp, compiled)

View on GitHub (pinned to 265b3a3dec)

Solutions

Rewrite JSONPath to jq syntax: '$.a.b[0]' becomes '.a.b[0]'
Verify the query with `gojq '.a.b' file.json` or `jq` on sample output before putting it in the template
Balance brackets/quotes and remove stray operators
Validate the template: `nuclei -validate -t template.yaml`

Example fix

# before
extractors:
  - type: json
    json:
      - '$.session.token'
# after
extractors:
  - type: json
    json:
      - '.session.token'

Defensive patterns

Strategy: validation

Validate before calling

import "github.com/itchyny/gojq"

for _, q := range ex.JSON {
	if _, err := gojq.Parse(q); err != nil {
		return fmt.Errorf("bad json extractor query %q: %w", q, err)
	}
}

Type guard

func validGojqQuery(q string) bool { _, err := gojq.Parse(q); return err == nil }

Try / catch

if err := ex.CompileExtractors(); err != nil && strings.Contains(err.Error(), "could not parse json") {
	// surface the query string plus a jq-syntax hint to the template author
}

Prevention

Use jq syntax (.a.b[0]), never JSONPath ($.a.b)
Prototype each query against a captured response with gojq/jq
Validate templates with -validate in CI

When it happens

Trigger: A json extractor query like '.a..[' (malformed recursive descent), unbalanced brackets/quotes, or non-jq syntax such as '.a.b(' or JSONPath-style '$.a.b' (jq uses '.a.b', not '$.').

Common situations: Using JSONPath ($.store.book[0].title) instead of jq syntax; missing quotes around filter expressions containing special chars; trailing commas or stray parentheses after refactoring a query.

Related errors

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/4bc43a7782e5594f. Report an issue: GitHub.