What causes "krbroast: no executionId on goja runtime" in projectdiscovery/nuclei?

Run the template through the nuclei engine (nuclei -t ... or the standard runner) so the JS protocol initializes the runtime with an execution ID

projectdiscovery/nuclei · error

krbroast: no executionId on goja runtime

Error message

krbroast: no executionId on goja runtime

What it means

Thrown by krbroast.ASRepRoast when the goja runtime carries no execution ID. The nuclei JS engine stamps an executionId onto each runtime so that network dials (dcerpc.NewExecDialer) can be routed through the protocol-state dialers and network policy; an empty ID means the library was invoked outside a properly initialized nuclei execution context.

Source

Thrown at pkg/js/libs/krbroast/krbroast.go:66

//	});
//
// log(hash);
// ```
func ASRepRoast(call goja.FunctionCall, vm *goja.Runtime) goja.Value {
	nj := utils.NewNucleiJS(vm)
	nj.ObjectSig = "ASRepRoast(request)"

	var req ASRepRoastRequest
	if err := vm.ExportTo(call.Argument(0), &req); err != nil {
		nj.ThrowError(fmt.Errorf("invalid ASRepRoastRequest: %w", err))
	}
	if req.Username == "" || req.Domain == "" || req.KDCHost == "" {
		nj.ThrowError(fmt.Errorf("Username, Domain and KDCHost are required")) //nolint
	}

	execID := nj.ExecutionId()
	if execID == "" {
		nj.ThrowError(fmt.Errorf("krbroast: no executionId on goja runtime"))
	}
	if !protocolstate.IsHostAllowed(execID, req.KDCHost) {
		nj.ThrowError(protocolstate.ErrHostDenied.Msgf(req.KDCHost))
	}

	hash, err := gpkrb.GetASREPWithDialer(dcerpc.NewExecDialer(execID), req.Username, req.Domain, req.KDCHost, req.Format)
	if err != nil {
		nj.ThrowError(err)
	}
	return vm.ToValue(hash)
}

// KerberoastRequest configures a Kerberoast attempt.
//
// One of Password / NTHash must be set. SPN is the service principal name to
// roast (e.g. "MSSQLSvc/sql01.acme.local:1433"). TargetUser, when set, is the
// account name embedded in the resulting hash string (defaults to Username).
type KerberoastRequest struct {

View on GitHub (pinned to 265b3a3dec)

Solutions

Run the template through the nuclei engine (nuclei -t ... or the standard runner) so the JS protocol initializes the runtime with an execution ID
Upgrade to the current nuclei release in case the execution-id plumbing changed
SDK/embedding users: ensure the JS protocol setup (protocolstate/dialers initialization) runs before template execution
If it fires during a normal nuclei run, report it as a bug with the template and version

Defensive patterns

Strategy: try-catch

Try / catch

try {
  const hash = krb.ASRepRoast(req);
} catch (e) {
  if (String(e).includes('no executionId')) {
    // engine/runtime misconfiguration, not a template bug: abort cleanly
    throw new Error('krbroast requires a nuclei-initialized runtime');
  }
  throw e;
}

Prevention

Run JS templates through the nuclei engine, not ad-hoc goja hosts
Keep nuclei and its bundled JS libs version-aligned (rebuild/upgrade together)
When embedding, initialize protocolstate/dialers before executing templates

When it happens

Trigger: Executing the krbroast JS binding from a hand-rolled goja runtime or a unit test that never registered an executionId; SDK embedding that creates a runtime without the nuclei execution plumbing; edge cases in old nuclei versions that predate execution-id binding.

Common situations: Developers prototyping nuclei JS libs outside the scanner; library consumers wiring goja directly; not reproducible from a normally launched nuclei template run (there it indicates an engine bug worth reporting).

Related errors

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/58973e9fd7890469. Report an issue: GitHub.