What causes "Invalid severity: %s" in projectdiscovery/nuclei?

Set severity to one of: info, low, medium, high, critical, unknown

Invalid severity: %s

Error message

Invalid severity: %s

What it means

Raised by toSeverity when unmarshalling a template's info.severity value. The input is normalized (TrimSpace + ToLower) and looked up in severityMappings; a miss returns -1 and the error 'Invalid severity: <raw input>'. Accepted values are info, low, medium, high, critical and unknown. Because SeverityHolder.UnmarshalYAML propagates it, one bad value aborts template parsing.

Source

Thrown at pkg/model/types/severity/severity.go:56

	Unknown:  "unknown",
}

func GetSupportedSeverities() Severities {
	var result []Severity
	for index := Severity(1); index < limit; index++ {
		result = append(result, index)
	}
	return result
}

func toSeverity(valueToMap string) (Severity, error) {
	normalizedValue := normalizeValue(valueToMap)
	for key, currentValue := range severityMappings {
		if normalizedValue == currentValue {
			return key, nil
		}
	}
	return -1, errors.New("Invalid severity: " + valueToMap)
}

func normalizeValue(value string) string {
	return strings.TrimSpace(strings.ToLower(value))
}

func (severity Severity) String() string {
	return severityMappings[severity]
}

// Holder holds a Severity type. Required for un/marshalling purposes
//
//nolint:exported,revive //prefer to be explicit about the name, and make it refactor-safe
type Holder struct {
	Severity Severity `mapping:"true"`
}

// Implement a jsonschema for the severity holder

View on GitHub (pinned to 265b3a3dec)

Solutions

Set severity to one of: info, low, medium, high, critical, unknown
Run nuclei -validate on the template to catch it before execution
If generating templates programmatically, restrict the enum at the generator side

Example fix

# before
info:
  severity: informational
# after
info:
  severity: info

Defensive patterns

Strategy: validation

Validate before calling

var validSeverities = map[string]bool{"info": true, "low": true, "medium": true, "high": true, "critical": true, "unknown": true}
func severityOK(s string) bool { return validSeverities[strings.ToLower(strings.TrimSpace(s))] }

Try / catch

if _, err := severity.SeverityHolder{...}; err != nil { ... } // or check strings.HasPrefix(err.Error(), "Invalid severity:")

Prevention

Constrain severity to the six-word enum at template-generation time
Run nuclei -validate in CI for every template change
Reject unknown severities in linters, not at scan time

When it happens

Trigger: A template with severity: informational, severity: severe, or a numeric/quoted variant that is not one of the six allowed words.

Common situations: Hand-edited templates; severity taxonomies from other tools (e.g. 'High ', 'MEDIUM' are fine after normalization, but 'med', 'critical-high' are not); automated template generation that emits arbitrary labels.

Related errors

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/813de84092c9c371. Report an issue: GitHub.