projectdiscovery/nuclei · error · ErrInvalidMethodArguments

invalid goexec method arguments: %w

Error message

invalid goexec method arguments: %w

What it means

The goexec WMI 'call' path failed to json.Unmarshal Request.MethodArgsJSON into a map, wrapping ErrInvalidMethodArguments. The 4th argument of wmi.Client.Call(namespace, className, method, argsJSON) must be a strict JSON object string; JS-style object text (single quotes, unquoted keys, trailing commas) or a JSON array/scalar string is rejected. Note the failure lands in the structured result (res.ok=false, res.error='invalid goexec method arguments: ...') rather than a thrown JS exception.

Source

Thrown at pkg/js/libs/goexec/adapter_goexec.go:112

				Client:   client,
				Resource: "//./root/cimv2",
			},
			WorkingDirectory: req.Options.Directory,
		}
		if err := upstream.ExecuteCleanMethod(ctx, module, execIO); err != nil {
			return err
		}
		collectExecutionOutput(req, result, execIO)
		return nil
	case "call":
		client, err := r.dceClient(ctx, req, "cifs", "")
		if err != nil {
			return err
		}
		args := map[string]any{}
		if req.MethodArgsJSON != "" {
			if err := json.Unmarshal([]byte(req.MethodArgsJSON), &args); err != nil {
				return fmt.Errorf("%w: %w", ErrInvalidMethodArguments, err)
			}
		}
		var out bytes.Buffer
		module := &gowmi.WmiCall{
			Wmi: gowmi.Wmi{
				Client:   client,
				Resource: defaultString(req.Namespace, "//./root/cimv2"),
			},
			Class:  req.ClassName,
			Method: req.MethodName,
			Args:   args,
			Out:    &out,
		}
		if module.Class == "" || module.Method == "" {
			return ErrInvalidMethodArguments
		}
		if err := upstream.ExecuteCleanAuxiliaryMethod(ctx, module); err != nil {
			return err

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Pass strict JSON: '{"Name":"value"}' with double quotes and no trailing commas.
2. Build the string in JS: JSON.stringify({Name: 'value'}).
3. Use '' (empty string) for no-arg methods.
4. Always inspect res.ok / res.error on goexec-backed calls — this error does not throw.

Example fix

// before
const res = wmiClient.Call('root\\cimv2', 'Win32_Process', 'Create', "{'CommandLine':'cmd /c whoami'}"); // res.ok=false, invalid goexec method arguments

// after
const args = JSON.stringify({CommandLine: 'cmd /c whoami'});
const res = wmiClient.Call('root\\cimv2', 'Win32_Process', 'Create', args);
if (!res.ok) log('wmi call failed: ' + res.error);

// strict-JSON object check before calling wmi.Client.Call
function isJsonObjectString(s) {
  if (typeof s !== 'string' || s.trim() === '') return s === ''; // '' = no args, allowed
  try {
    const v = JSON.parse(s);
    return v !== null && typeof v === 'object' && !Array.isArray(v);
  } catch (_) { return false; }
}
if (!isJsonObjectString(argsJSON)) {
  throw new Error('argsJSON must be strict JSON like {\"Name\":\"value\"}, got: ' + argsJSON);
}

/** @param {unknown} s @returns {boolean} */
function isStrictJsonObjectString(s) {
  if (typeof s !== 'string' || s === '') return s === '';
  try {
    const v = JSON.parse(s);
    return !!v && typeof v === 'object' && !Array.isArray(v);
  } catch (_) { return false; }
}

const res = wmiClient.Call(ns, cls, method, argsJSON);
if (!res.ok && String(res.error).includes('invalid goexec method arguments')) {
  // malformed JSON args: rebuild with JSON.stringify and retry once
  const fixed = JSON.stringify(JSON.parse(JSON.stringify(args)));
}

When it happens

Trigger: wmi.Call('root\\cimv2', 'Win32_Process', 'Create', "{'CommandLine':'cmd /c whoami'}") — single quotes/unquoted keys; also a JSON array string '[1,2]' or scalar '"x"' instead of an object. Triggered only for non-empty strings; '' skips the unmarshal.

Common situations: Template authors hand-writing JS object literals as strings; passing values built by string concatenation; forgetting the argument is JSON, not JS.

Related errors

• invalid goexec method arguments
• failed to build request parser: %w
• unsupported goexec method
• unsupported goexec output method
• grpc target host cannot be empty

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/aa3283a6b7c6b9ce. Report an issue: GitHub.