projectdiscovery/nuclei · error

unresolved variables with values found

Error message

unresolved variables with values found: %s

What it means

Raised by ContainsVariablesWithNames (variables.go:112), the stricter sibling of the unresolved-variable checker. It checks only for {{markers}} whose names appear in the provided names map (minus an explicit skipNames exemption) and errors with 'unresolved variables with values found: x,y' when any of those named variables are still unresolved in the given items. It is used where the caller knows exactly which variables must be substituted.

Solutions

1. Ensure every named variable in the map has a concrete value before building the final request
2. Order flow/extract steps so dependencies resolve before the consuming request
3. If a marker may legitimately remain, route it through the skipNames mechanism the API exposes

if err := expressions.ContainsVariablesWithNames(valuesMap, raw1, raw2); err != nil {
    // populate missing keys before building final requests
}

func hasUnresolvedNamedVariables(err error) bool { return strings.HasPrefix(err.Error(), "unresolved variables with values found:") }

err := expressions.ContainsVariablesWithNames(names, items...)
if err != nil { missing := strings.Split(strings.TrimPrefix(err.Error(), "unresolved variables with values found: "), ",") /* fill or skip */ }

When it happens

Trigger: A protocol engine passes a values map (e.g. extracted or payload values) plus request strings; one of the mapped names, say {{baseURL}}, still appears verbatim in a raw request because its value was never merged in.

Common situations: A flow step fails to run before the request is built; an extractor returned empty so the value never entered the map; SDK users call the request builder without supplying all declared dynamic values.

Related errors

• unresolved variables found
• case-insensitive flag is supported only for 'kval'…
• case-insensitive flag is supported only for 'word' matchers
• could not compile flow
• empty operators

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/0c959976fb8e9527. Report an issue: GitHub.

Appendix: source

Thrown at pkg/protocols/common/expressions/variables.go:112

			}
			matchName := match[1]
			// Skip if the match is an expression
			if numericalExpressionRegex.MatchString(matchName) {
				continue
			}
			// or if it contains only literals (can be solved from expression engine)
			if hasLiteralsOnly(match[1]) {
				continue
			}
			if _, ok := skipNames[matchName]; ok {
				continue
			}
			unresolvedVariables = append(unresolvedVariables, matchName)
		}
	}

	if len(unresolvedVariables) > 0 {
		return errors.New("unresolved variables with values found: " + strings.Join(unresolvedVariables, ","))
	}

	return nil
}

func hasLiteralsOnly(data string) bool {
	expr, err := govaluate.NewEvaluableExpressionWithFunctions(data, dsl.HelperFunctions)
	if err != nil {
		return false
	}

	if expr == nil {
		return true
	}

	return len(expr.Vars()) == 0
}

View on GitHub (pinned to 265b3a3dec)