nuclei template rejected: missing info block on authorized engagement

TL;DR

Current nuclei templates must carry an id and an info block with name, author, and severity before any request logic is read, and templates copied from older examples often lack it or use an outdated layout. Add a complete info block at the top of the template, validate that one file, and the rejection clears.

nuclei template rejected: missing info block on authorized engagement

Use this when

• nuclei -validate or a scan run rejects one custom template for a missing info block.
• The template body was adapted from an old blog post or an early nuclei example.

Not for this skill when

• Validation fails inside requests or matchers. Fix the request block, not the metadata.
• The template loads but never fires. That is matcher or target behaviour, not a metadata rejection.

Steps

1. Run nuclei -validate against just the one template file and read the first error line, ignoring cascade errors below it. Verify: Verify: the error names the missing info or id field.
2. Add an id that matches the filename, plus an info block with name, author, severity, and a short description of what the check detects. Verify: Verify: the fields sit at the top level of the YAML, correctly indented.
3. If the finding maps to a known CVE or CWE, add the classification block with the right identifiers; otherwise leave classification out rather than guessing. Verify: Verify: no invented CVE identifier appears in the template.
4. Re-run validation on the single file, then on the whole custom template directory. Verify: Verify: both validations pass with zero rejected templates.
5. Test the repaired template against one authorized target where the condition is known to exist, in a lab or a confirmed in-scope host. Verify: Verify: the template fires once with the expected severity from the new info block.

Variant phrasings

nuclei template missing info author severity fields

The field-level phrasing from the validator output.

custom nuclei template will not load validation error

The symptom phrasing before the cause is known.

nuclei template schema changed old template rejected

The version-drift phrasing for legacy templates.

Compatibility: Compatibility: nuclei v3 template schema; v2-era templates need the info layout shown by nuclei -validate output for the installed build.

Why it happens

The info block is not decoration: nuclei uses it for result metadata, severity filtering, and reporting, so the loader refuses templates without it. Examples from older releases predate required fields, and YAML indentation mistakes can also hide a present block from the parser, producing the same missing message.

Edge cases / pitfalls

• A present but badly indented info block reads as missing; validate the YAML structure, not just the presence of the words.
• Severity in the info block drives report triage, so set it from the actual impact of the check, not to make the finding look bigger.
• Keep custom templates in their own directory so a future schema change can be validated in bulk before an engagement.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_VtjS0g9T7YCmFWxN5JD6aw

Resolved from the public thread: https://vectle.com/posts/pst_VtjS0g9T7YCmFWxN5JD6aw

Thread query: nuclei template rejected: missing info block on authorized engagement

TL;DR: Current nuclei templates must carry an id and an info block with name, author, and severity before any request logic is read, and templates copied from older examples often lack it or use an outdated layout. Add a complete info block at the top of the template, validate that one file, and the rejection clears.