What causes "only one target URL is supported in %s input mode" in projectdiscovery/nuclei?

Run nuclei once per spec URL (loop the command in your shell or script)

only one target URL is supported in %s input mode

Error message

only one target URL is supported in %s input mode

What it means

provider.NewInputProvider rejects configurations where more than one target is supplied together with `-input-file-mode openapi` or `swagger` (pkg/input/provider/interface.go). Remote spec download supports exactly one spec URL per run because the single downloaded file becomes TargetsFilePath for the whole scan.

Source

Thrown at pkg/input/provider/interface.go:120

			parts := strings.SplitN(v, "=", 2)
			if len(parts) == 2 {
				extraVars[parts[0]] = parts[1]
			}
		}
	}

	// check if input provider is supported
	if strings.EqualFold(opts.Options.InputFileMode, "list") {
		// create a new list input provider
		return list.New(&list.Options{
			Options:          opts.Options,
			NotFoundCallback: opts.NotFoundCallback,
		})
	} else if len(opts.Options.Targets) > 0 &&
		(strings.EqualFold(opts.Options.InputFileMode, "openapi") || strings.EqualFold(opts.Options.InputFileMode, "swagger")) {

		if len(opts.Options.Targets) > 1 {
			return nil, fmt.Errorf("only one target URL is supported in %s input mode", opts.Options.InputFileMode)
		}

		target := opts.Options.Targets[0]
		if strings.HasPrefix(target, "http://") || strings.HasPrefix(target, "https://") {
			var downloader formats.SpecDownloader
			var tempFile string
			var err error

			// Get HttpClient from protocolstate if available
			var httpClient *retryablehttp.Client
			if opts.Options.ExecutionId != "" {
				dialers := protocolstate.GetDialersWithId(opts.Options.ExecutionId)
				if dialers != nil {
					httpClient = dialers.DefaultHTTPClient
				}
			}

			switch strings.ToLower(opts.Options.InputFileMode) {

View on GitHub (pinned to 265b3a3dec)

Solutions

Run nuclei once per spec URL (loop the command in your shell or script)
Download each spec locally and scan the files with list mode: nuclei -l specs.txt (auto-detect per file)
For mixed endpoints, aggregate all URLs in a plain file and use default list mode instead of openapi/swagger mode

Example fix

# before
nuclei -im openapi -u https://a.com/openapi.json -u https://b.com/openapi.json

# after
for u in https://a.com/openapi.json https://b.com/openapi.json; do
  nuclei -im openapi -u "$u"
done

Defensive patterns

Strategy: validation

Validate before calling

if (strings.EqualFold(mode, "openapi") || strings.EqualFold(mode, "swagger")) && len(targets) > 1 {
    return fmt.Errorf("%s mode accepts one spec URL; pass the rest as separate runs", mode)
}

Try / catch

if err != nil && strings.Contains(err.Error(), "only one target URL is supported") {
    // split the target list and invoke one scan per URL
}

Prevention

Loop one URL per nuclei invocation in openapi/swagger mode
Use list mode with downloaded local spec files for batch scans
Assert len(targets)==1 in wrapper scripts before spawning nuclei

When it happens

Trigger: `nuclei -im openapi -u url1 -u url2`; multiple -target flags with openapi/swagger mode; multiple URL targets piped via stdin while -im openapi is set (both funnel into Options.Targets).

Common situations: Batch-scanning several APIs with one command; muscle memory from list mode where many -u flags are normal; automation scripts looping a URL list into a single nuclei invocation.

Related errors

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/a3157d5ca69b1ad9. Report an issue: GitHub.