What causes "unknown condition specified: %s" in projectdiscovery/nuclei?

Use exactly lowercase `condition: and` or `condition: or`

unknown condition specified: %s

Error message

unknown condition specified: %s

What it means

Template compilation error from Matcher.CompileMatchers (pkg/operators/matchers/compile.go:86). When `condition:` is set, it is looked up in the ConditionTypes map whose keys are exactly lowercase "and" and "or" (matchers.go:151-153) with NO case normalization or trimming. Any other string — including uppercase 'AND'/'OR' — fails here; an empty condition defaults to OR.

Source

Thrown at pkg/operators/matchers/compile.go:86

	// Compile the dsl expressions (with shared cache)
	for _, dslExpression := range matcher.DSL {
		if cached, err := cache.DSL().GetIFPresent(dslExpression); err == nil && cached != nil {
			matcher.dslCompiled = append(matcher.dslCompiled, cached)
			continue
		}
		compiledExpression, err := govaluate.NewEvaluableExpressionWithFunctions(dslExpression, dsl.HelperFunctions)
		if err != nil {
			return &dsl.CompilationError{DslSignature: dslExpression, WrappedError: err}
		}
		_ = cache.DSL().Set(dslExpression, compiledExpression)
		matcher.dslCompiled = append(matcher.dslCompiled, compiledExpression)
	}

	// Set up the condition type, if any.
	if matcher.Condition != "" {
		matcher.condition, ok = ConditionTypes[matcher.Condition]
		if !ok {
			return fmt.Errorf("unknown condition specified: %s", matcher.Condition)
		}
	} else {
		matcher.condition = ORCondition
	}

	if matcher.CaseInsensitive {
		if matcher.GetType() != WordsMatcher {
			return fmt.Errorf("case-insensitive flag is supported only for 'word' matchers (not '%s')", matcher.Type)
		}
		for i := range matcher.Words {
			matcher.Words[i] = strings.ToLower(matcher.Words[i])
		}
	}
	return nil
}

// GetType returns the condition type of the matcher
// todo: the field should be exposed natively

View on GitHub (pinned to 265b3a3dec)

Solutions

Use exactly lowercase `condition: and` or `condition: or`
Omit `condition:` entirely if OR (the default) is intended
Re-validate the template: `nuclei -validate -t template.yaml`
When generating templates programmatically, emit the constant strings 'and'/'or' only

Example fix

# before
matchers:
  - type: word
    condition: AND
    words:
      - 'root'
      - 'admin'
# after
matchers:
  - type: word
    condition: and
    words:
      - 'root'
      - 'admin'

Defensive patterns

Strategy: validation

Validate before calling

if m.Condition != "" && m.Condition != "and" && m.Condition != "or" {
	return fmt.Errorf("condition %q must be exactly 'and' or 'or' (lowercase)", m.Condition)
}

Type guard

func validCondition(c string) bool { return c == "" || c == "and" || c == "or" }

Try / catch

if err := m.CompileMatchers(); err != nil && strings.Contains(err.Error(), "unknown condition specified") {
	// lowercase the value and retry once, else reject template
}

Prevention

Write conditions lowercase: 'and' / 'or'
Omit condition when OR default is fine
Programmatic template generators: use string constants, never user input

When it happens

Trigger: `condition: AND` or `condition: Or` (capitalized), `condition: and-or`, `condition: "true"`, or a value with stray whitespace/quotes from templating.

Common situations: Templates written with YAML conventions favoring uppercase keys; copy-paste from docs that capitalize; unquoted YAML values carrying trailing spaces.

Related errors

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/ad51ead9509c14b6. Report an issue: GitHub.