projectdiscovery/nuclei · error

outputFile must be a string

Error message

outputFile must be a string

What it means

Thrown by exportOutputFile in krbforge when the second argument to CreateSilverTicket is neither undefined/null nor a string. The helper explicitly accepts only an absent value or a string path; any other JS type (number, boolean, object, array) fails the value.Export().(string) assertion.

Source

Thrown at pkg/js/libs/krbforge/krbforge.go:253

	return "", fmt.Errorf("path %v is outside nuclei-template directory and -allow-local-file-access is not enabled", outputFile)
}

func exportTicketRequest(vm *goja.Runtime, value goja.Value) (TicketRequest, error) {
	var req TicketRequest
	if err := vm.ExportTo(value, &req); err != nil {
		return req, fmt.Errorf("invalid TicketRequest: %w", err)
	}
	return req, nil
}

func exportOutputFile(value goja.Value) (string, error) {
	if goja.IsUndefined(value) || goja.IsNull(value) {
		return "", nil
	}
	outputFile, ok := value.Export().(string)
	if !ok {
		return "", fmt.Errorf("outputFile must be a string")
	}
	return outputFile, nil
}

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Pass a string path or omit the second argument entirely: krb.CreateSilverTicket(req) or krb.CreateSilverTicket(req, 'silver.ccache')
2. Pass undefined/null explicitly when no output file is wanted (both are accepted and treated as no file)
3. If the path is computed, coerce it: krb.CreateSilverTicket(req, String(pathVar))

Example fix

// before
krb.CreateSilverTicket(req, {path: '/tmp/silver.ccache'}); // object, not string

// after
krb.CreateSilverTicket(req, '/tmp/silver.ccache');

// only string, undefined or null are accepted for outputFile
const okOutputFile = (v) => v === undefined || v === null || typeof v === 'string';
if (!okOutputFile(secondArg)) throw new Error('outputFile must be a string path or omitted');

try {
  krb.CreateSilverTicket(req, outputFile);
} catch (e) {
  if (String(e).includes('outputFile must be a string')) {
    krb.CreateSilverTicket(req); // retry without file output
  }
}

When it happens

Trigger: krb.CreateSilverTicket(req, 42), krb.CreateSilverTicket(req, true), or passing an object like {path: '/tmp/x'} as the outputFile argument.

Common situations: Template logic that conditionally builds an options object and passes it as arg 2 by mistake; passing a port or timeout number in the wrong positional slot; copying a call signature from a different library that takes an options object.

Related errors

• invalid TicketRequest: %w
• invalid ASRepRoastRequest: %w
• invalid KerberoastRequest: %w
• spn is required for silver ticket
• path %v is outside nuclei-template directory and -allow-loca

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/23218280b91f0b2d. Report an issue: GitHub.