projectdiscovery/nuclei · error

could not parse profile YAML: %w

Error message

could not parse profile YAML: %w

What it means

After reading, the profile YAML is unmarshaled into profileSecrets (cmd/nuclei/main.go:885); malformed YAML fails with 'could not parse profile YAML'. Only syntax validity matters at this stage — the secrets section is decoded loosely into interface{} — so this error indicates broken YAML (tab indentation, bad quoting, stray characters) rather than a semantically wrong secrets block. The wrapped %w error includes line/column from the decoder.

Source

Thrown at cmd/nuclei/main.go:885

}

// profileSecrets is a helper struct to extract secrets section from a template profile YAML
type profileSecrets struct {
	Secrets interface{} `yaml:"secrets"`
}

// processInlineSecretsFromProfile parses the profile YAML file for inline secrets
// and creates a temporary secrets file compatible with nuclei's auth provider.
// Returns the path to the temp file or empty string if no secrets found.
func processInlineSecretsFromProfile(profilePath string, options *types.Options) (string, error) {
	data, err := os.ReadFile(profilePath)
	if err != nil {
		return "", fmt.Errorf("could not read profile file: %w", err)
	}

	var profile profileSecrets
	if err := yaml.Unmarshal(data, &profile); err != nil {
		return "", fmt.Errorf("could not parse profile YAML: %w", err)
	}

	if profile.Secrets == nil {
		return "", nil
	}

	secretsData, err := yaml.Marshal(profile.Secrets)
	if err != nil {
		return "", fmt.Errorf("could not marshal inline secrets: %w", err)
	}

	tempDir := filepath.Join(os.TempDir(), "nuclei-secrets")
	if err := os.MkdirAll(tempDir, 0700); err != nil {
		return "", fmt.Errorf("could not create temp directory: %w", err)
	}

	tempFile, err := os.CreateTemp(tempDir, "inline-secrets-*.yaml")
	if err != nil {

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Lint the file (`yamllint profile.yaml`) or expose hidden characters (`cat -A`)
2. Convert tabs to spaces and fix indentation of the whole document
3. Quick syntax check with any YAML parser before running nuclei
4. Regenerate the profile from a known-good template

// cheap syntax pre-check with line numbers
var node yaml.Node
if err := yaml.Unmarshal(raw, &node); err != nil {
    return fmt.Errorf("profile YAML syntax error: %w", err)
}

var p profileSecrets
if err := yaml.Unmarshal(data, &p); err != nil {
    return fmt.Errorf("profile %s is malformed YAML (check tabs/indentation): %w", path, err)
}

When it happens

Trigger: A profile file with tab characters for indentation, unbalanced quotes/brackets, invalid escape sequences, or non-UTF8 bytes anywhere in the document.

Common situations: Hand-edited profiles pasted from docs where terminals inserted tabs; BOM or CRLF issues from Windows editors; partial rewrites truncating the file.

Related errors

• include directive preprocessing is disabled
• could not read profile file: %w
• could not marshal inline secrets: %w
• Invalid protocol type: {valueToMap}
• invalid workflow with no templates or tags

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/5c6a7b329584d3d8. Report an issue: GitHub.