shadow1ng/fscan · error

fscan: plugin %q is not enabled for embedded safe mode

Error message

fscan: plugin %q is not enabled for embedded safe mode

What it means

Validation in validateConfig: the requested plugin exists but is not in the embedded safe-mode allowlist, and AllowUnsafePlugins is false — embedded library consumers must explicitly opt in to unsafe plugins.

Source

Thrown at pkg/fscan/scanner.go:342

	if opts.controller != nil {
		session.PauseGate = opts.controller.pauseGate
		opts.controller.addState(state)
	}

	return core.RunScan(ctx, info, session)
}

func validateConfig(config Config, targets []Target) error {
	if len(targets) == 0 {
		return fmt.Errorf("fscan: at least one target is required")
	}
	for _, name := range normalizePlugins(config.Plugins) {
		if !plugins.Exists(name) {
			return fmt.Errorf("fscan: plugin %q not found", name)
		}
		if !config.AllowUnsafePlugins && !IsSafePlugin(name) {
			return fmt.Errorf("fscan: plugin %q is not enabled for embedded safe mode", name)
		}
	}
	for _, target := range targets {
		if strings.TrimSpace(target.Host) == "" && strings.TrimSpace(target.URL) == "" {
			return fmt.Errorf("fscan: target host or URL is required")
		}
		if strings.TrimSpace(target.Host) != "" && strings.TrimSpace(target.URL) != "" {
			return fmt.Errorf("fscan: target cannot set both Host and URL")
		}
		for _, port := range target.Ports {
			if port < 1 || port > 65535 {
				return fmt.Errorf("fscan: invalid port %d", port)
			}
		}
	}
	for _, port := range config.Ports {
		if port < 1 || port > 65535 {
			return fmt.Errorf("fscan: invalid port %d", port)

View on GitHub (pinned to 95cc12e753)

Solutions

1. Set AllowUnsafePlugins=true if the plugin is trusted in your embedding context
2. Choose an equivalent safe-listed plugin
3. Whitelist the plugin in IsSafePlugin if you maintain the allowlist

When it happens

Trigger: Thrown at pkg/fscan/scanner.go:342 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/fe42c5e2e53e212a. Report an issue: GitHub.