What causes "unresolved variables with values found: %s" in projectdiscovery/nuclei?

Ensure every named variable in the map has a concrete value before building the final request

unresolved variables with values found: %s

Error message

unresolved variables with values found: %s

What it means

Raised by ContainsVariablesWithNames (variables.go:112), the stricter sibling of the unresolved-variable checker. It checks only for {{markers}} whose names appear in the provided names map (minus an explicit skipNames exemption) and errors with 'unresolved variables with values found: x,y' when any of those named variables are still unresolved in the given items. It is used where the caller knows exactly which variables must be substituted.

Source

Thrown at pkg/protocols/common/expressions/variables.go:112

			}
			matchName := match[1]
			// Skip if the match is an expression
			if numericalExpressionRegex.MatchString(matchName) {
				continue
			}
			// or if it contains only literals (can be solved from expression engine)
			if hasLiteralsOnly(match[1]) {
				continue
			}
			if _, ok := skipNames[matchName]; ok {
				continue
			}
			unresolvedVariables = append(unresolvedVariables, matchName)
		}
	}

	if len(unresolvedVariables) > 0 {
		return errors.New("unresolved variables with values found: " + strings.Join(unresolvedVariables, ","))
	}

	return nil
}

func hasLiteralsOnly(data string) bool {
	expr, err := govaluate.NewEvaluableExpressionWithFunctions(data, dsl.HelperFunctions)
	if err != nil {
		return false
	}

	if expr == nil {
		return true
	}

	return len(expr.Vars()) == 0
}

View on GitHub (pinned to 265b3a3dec)

Solutions

Ensure every named variable in the map has a concrete value before building the final request
Order flow/extract steps so dependencies resolve before the consuming request
If a marker may legitimately remain, route it through the skipNames mechanism the API exposes

Defensive patterns

Strategy: validation

Validate before calling

if err := expressions.ContainsVariablesWithNames(valuesMap, raw1, raw2); err != nil {
    // populate missing keys before building final requests
}

Type guard

func hasUnresolvedNamedVariables(err error) bool { return strings.HasPrefix(err.Error(), "unresolved variables with values found:") }

Try / catch

err := expressions.ContainsVariablesWithNames(names, items...)
if err != nil { missing := strings.Split(strings.TrimPrefix(err.Error(), "unresolved variables with values found: "), ",") /* fill or skip */ }

Prevention

Ensure flow/extract steps complete before dependent requests
Pass only names you can guarantee values for
Use the skip set for markers that intentionally stay literal

When it happens

Trigger: A protocol engine passes a values map (e.g. extracted or payload values) plus request strings; one of the mapped names, say {{baseURL}}, still appears verbatim in a raw request because its value was never merged in.

Common situations: A flow step fails to run before the request is built; an extractor returned empty so the value never entered the map; SDK users call the request builder without supplying all declared dynamic values.

Related errors

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/0c959976fb8e9527. Report an issue: GitHub.