projectdiscovery/nuclei · error

unsupported input mode: %s

Error message

unsupported input mode: %s

What it means

Defensive default branch in provider.NewInputProvider's mode switch. Execution can only reach it when InputFileMode already case-insensitively matched "openapi" or "swagger" in the outer condition, and the lowercased switch handles exactly those two values, so in shipped code this branch is unreachable. Seeing it means a build divergence, a patched/forked binary, or a new mode was added to the outer check without a switch case.

Source

Thrown at pkg/input/provider/interface.go:146

			// Get HttpClient from protocolstate if available
			var httpClient *retryablehttp.Client
			if opts.Options.ExecutionId != "" {
				dialers := protocolstate.GetDialersWithId(opts.Options.ExecutionId)
				if dialers != nil {
					httpClient = dialers.DefaultHTTPClient
				}
			}

			switch strings.ToLower(opts.Options.InputFileMode) {
			case "openapi":
				downloader = openapi.NewDownloader()
				tempFile, err = downloader.Download(target, opts.TempDir, httpClient)
			case "swagger":
				downloader = swagger.NewDownloader()
				tempFile, err = downloader.Download(target, opts.TempDir, httpClient)
			default:
				return nil, fmt.Errorf("unsupported input mode: %s", opts.Options.InputFileMode)
			}

			if err != nil {
				return nil, fmt.Errorf("failed to download %s spec from url %s: %w", opts.Options.InputFileMode, target, err)
			}

			opts.Options.TargetsFilePath = tempFile
		}
	}

	return http.NewHttpInputProvider(&http.HttpMultiFormatOptions{
		InputFile: opts.Options.TargetsFilePath,
		InputMode: opts.Options.InputFileMode,
		Options: formats.InputFormatOptions{
			Variables:            generators.MergeMaps(extraVars, opts.Options.Vars.AsMap()),
			SkipFormatValidation: opts.Options.SkipFormatValidation,
			RequiredOnly:         opts.Options.FormatUseRequiredOnly,
			VarsTextTemplating:   opts.Options.VarsTextTemplating,

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Confirm you are running an official build: `nuclei -version` and reinstall from the release channel
2. If using a fork that added a mode, add a matching case to the switch in pkg/input/provider/interface.go
3. SDK callers: treat this message as an assertion failure and report it upstream with the exact InputFileMode value

Example fix

// when adding a new download mode to the outer condition, extend the switch
// before
} else if len(opts.Options.Targets) > 0 &&
    (strings.EqualFold(opts.Options.InputFileMode, "openapi") || strings.EqualFold(opts.Options.InputFileMode, "swagger")) {
    switch strings.ToLower(opts.Options.InputFileMode) {
    case "openapi": ...
    case "swagger": ...
    }

// after
} else if len(opts.Options.Targets) > 0 &&
    (strings.EqualFold(opts.Options.InputFileMode, "openapi") || strings.EqualFold(opts.Options.InputFileMode, "swagger") || strings.EqualFold(opts.Options.InputFileMode, "postman")) {
    switch strings.ToLower(opts.Options.InputFileMode) {
    case "openapi": ...
    case "swagger": ...
    case "postman": ... // keep outer set and switch in sync
    }

allowed := map[string]bool{"list": true, "openapi": true, "swagger": true}
if !allowed[strings.ToLower(opts.Options.InputFileMode)] {
    return fmt.Errorf("input mode %q is not a downloadable-spec mode; use list", opts.Options.InputFileMode)
}

func isKnownDownloadMode(mode string) bool {
    m := strings.ToLower(mode)
    return m == "openapi" || m == "swagger"
}

if err != nil && strings.Contains(err.Error(), "unsupported input mode") {
    // stock builds cannot reach this; verify binary provenance (nuclei -version) and report upstream
}

When it happens

Trigger: Running a forked or modified nuclei where the outer EqualFold condition accepts another mode string not present in the inner switch; a future regression that loosens the outer condition; in practice never triggered by stock flag values (typos fall through to the list/HTTP provider path instead).

Common situations: Custom internal builds adding a new input mode; SDK callers mutating Options.InputFileMode between validation and provider creation; version mismatches after cherry-picking commits.

Related errors

• only one target URL is supported in %s input mode
• headless mode (-headless) is required if -ho, -sb, -sc or -l
• both follow host redirects and follow redirects specified
• both follow redirects and disable redirects specified
• include directive preprocessing is disabled

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/088cb7811a4464e7. Report an issue: GitHub.