projectdiscovery/nuclei · error

invalid goexec method arguments

Error message

invalid goexec method arguments

What it means

Sentinel error from the goexec helper, raised only on the wmi module's 'call' branch. Two conditions produce it (adapter_goexec.go:109-128): (a) method-args is non-empty but fails json.Unmarshal, in which case the sentinel is wrapped with the underlying JSON error via fmt.Errorf("%w: %w"); (b) the WMI class-name or method-name field is empty.

Source

Thrown at pkg/js/libs/goexec/errors.go:16

package goexec

import "errors"

var (
	ErrMissingAuth             = errors.New("goexec auth is required")
	ErrMissingUsername         = errors.New("goexec username is required for this auth mode")
	ErrMultipleCredentialModes = errors.New("goexec auth selects multiple primary credential modes")
	ErrMissingTarget           = errors.New("goexec target is required")
	ErrMissingCommand          = errors.New("goexec command is required")
	ErrMissingExecutable       = errors.New("goexec executable is required")
	ErrUnsupportedModule       = errors.New("unsupported goexec module")
	ErrUnsupportedMethod       = errors.New("unsupported goexec method")
	ErrUnsupportedOutputMethod = errors.New("unsupported goexec output method")
	ErrNetworkPolicyDenied     = errors.New("target denied by network policy")
	ErrInvalidMethodArguments  = errors.New("invalid goexec method arguments")
	ErrDomainControllerDenied  = errors.New("domain controller denied by network policy")
	ErrProxyDenied             = errors.New("proxy denied by network policy")
	ErrEndpointDenied          = errors.New("endpoint denied by network policy")
)

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Fix the method-args JSON so it unmarshals into map[string]any (double quotes, no trailing commas)
2. Always provide non-empty class-name and method-name when using the wmi call method
3. If args are unnecessary, leave method-args empty rather than passing malformed JSON

Example fix

// before
{module: 'wmi', method: 'call', 'method-args': '{Query: "SELECT * FROM Win32_Process"}'}
// after
{module: 'wmi', method: 'call', 'class-name': 'Win32_Process', 'method-name': 'Create', 'method-args': '{CommandLine: "whoami"}'}

if req.Method == "call" {
    if req.ClassName == "" || req.MethodName == "" {
        return errors.New("wmi call needs class-name and method-name")
    }
    if req.MethodArgsJSON != "" {
        if !json.Valid([]byte(req.MethodArgsJSON)) {
            return errors.New("method-args is not valid JSON")
        }
    }
}

func isInvalidMethodArguments(err error) bool { return errors.Is(err, goexec.ErrInvalidMethodArguments) }

When it happens

Trigger: goexec call with method-args: '{bad json'; goexec call with class-name or method-name omitted or left as an empty string.

Common situations: Hand-written JSON in method-args with a trailing comma or single quotes; template fills class-name from an extractor that returned empty; author assumes method-name is optional.

Related errors

• invalid goexec method arguments: %w
• unsupported goexec method
• unsupported goexec output method
• failed to build request parser: %w
• validation failed for these fields

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/87967c733a7ece52. Report an issue: GitHub.