JS 1.0 · Project evidence

JS Todo App (SQLite 5): Find Vulnerabilities

Uptime and health check app with Express. Scaffolded from Cursor's Auto MAX mode.

Project purpose and scale

JS Todo App (SQLite 5): Find Vulnerabilities

Uptime and health check app with Express. Scaffolded from Cursor's Auto MAX mode.

Source files
8
Reference findings
11
Matched signatures
37
Unmatched signatures
23

Reference context

Deterministic reference findings

These findings define the project reference set for JS 1.0. Their presence does not establish exhaustive ground truth.

ClassSeverityLocationReference ID
improper-type-validationlowserver.js:85js-improper-type-validation-5
information-exposurelowserver.js:37js-cookie-secure-flag-false-5
csrfmediumserver.js:17js-csrf-missing-5
information-exposuremediumserver.js:17js-xpowered-by-header-5
allocation-of-resources-without-limits-or-throttlingmediumserver.js:176js-alloc-without-limits-5a
allocation-of-resources-without-limits-or-throttlingmediumserver.js:186js-alloc-without-limits-5b
allocation-of-resources-without-limits-or-throttlingmediumserver.js:221js-alloc-without-limits-5c
open-redirectmediumserver.js:218js-open-redirect-5
command-injectionhighserver.js:124js-command-injection-5
hardcoded-credentialshighserver.js:33js-hardcoded-secret-5
ssrfhighserver.js:139js-ssrf-5

Finding evidence

Reference-matched normalized signatures

Matched means agreement with the Snyk Code reference set, not independent ground-truth adjudication.

Severity and description show the deterministic most-frequent metadata variant; the final column records how many variants were observed across repetitions.

ConfigurationClassRepresentative severityLocationRecurrenceRepresentative descriptionMetadata variants
Claude Opus 4.6 Highcommand-injectionhighserver.js:1245 of 5Unsanitized input from the HTTP request body flows into promisified command execution function, where it is used to build a shell command. This may result in a Command Injection vulnerability.1
Claude Opus 4.6 Highhardcoded-credentialshighserver.js:335 of 5Avoid hardcoding values that are meant to be secret. Found a hardcoded string used in express-session.1
Claude Opus 4.6 Highinformation-exposurelowserver.js:371 of 5Cookie has the Secure attribute set to false. Set it to true to protect the cookie from man-in-the-middle attacks.1
Claude Opus 4.6 Highopen-redirectmediumserver.js:2185 of 5Unsanitized input from an HTTP parameter flows into redirect, where it is used as input for request redirection. This may result in an Open Redirect vulnerability.1
Claude Opus 4.6 Highssrfhighserver.js:1395 of 5Unsanitized input from the HTTP request body flows into fetch, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability.1
Claude Opus 4.6 Mediumcommand-injectionhighserver.js:1245 of 5Unsanitized input from the HTTP request body flows into promisified command execution function, where it is used to build a shell command. This may result in a Command Injection vulnerability.1
Claude Opus 4.6 Mediumhardcoded-credentialshighserver.js:335 of 5Avoid hardcoding values that are meant to be secret. Found a hardcoded string used in express-session.1
Claude Opus 4.6 Mediumopen-redirectmediumserver.js:2185 of 5Unsanitized input from an HTTP parameter flows into redirect, where it is used as input for request redirection. This may result in an Open Redirect vulnerability.1
Claude Opus 4.6 Mediumssrfhighserver.js:1395 of 5Unsanitized input from the HTTP request body flows into fetch, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability.1
Claude Opus 4.7 Maxallocation-of-resources-without-limits-or-throttlingmediumserver.js:1765 of 5Expensive operation (a file system operation) is performed by an endpoint handler which does not use a rate-limiting mechanism. It may enable the attackers to perform Denial-of-service attacks. Consider using a rate-limiting middleware such as express-limit.1
Claude Opus 4.7 Maxallocation-of-resources-without-limits-or-throttlingmediumserver.js:1861 of 5Expensive operation (a file system operation) is performed by an endpoint handler which does not use a rate-limiting mechanism. It may enable the attackers to perform Denial-of-service attacks. Consider using a rate-limiting middleware such as express-limit.1
Claude Opus 4.7 Maxcommand-injectionhighserver.js:1245 of 5Unsanitized input from the HTTP request body flows into promisified command execution function, where it is used to build a shell command. This may result in a Command Injection vulnerability.1
Claude Opus 4.7 Maxcsrfmediumserver.js:175 of 5CSRF protection is disabled for your Express app. This allows the attackers to execute requests on a user's behalf.1
Claude Opus 4.7 Maxhardcoded-credentialshighserver.js:335 of 5Avoid hardcoding values that are meant to be secret. Found a hardcoded string used in express-session.1
Claude Opus 4.7 Maximproper-type-validationlowserver.js:854 of 5The type of this object, coming from body and the value of its trim property can be controlled by the user. An attacker may craft the properties of the object to crash the application or bypass its logic. Consider checking the type of the object.1
Claude Opus 4.7 Maxinformation-exposuremediumserver.js:171 of 5Disable X-Powered-By header for your Express app (consider using Helmet middleware), because it exposes information about the used framework to potential attackers.1
Claude Opus 4.7 Maxinformation-exposurelowserver.js:375 of 5Cookie has the Secure attribute set to false. Set it to true to protect the cookie from man-in-the-middle attacks.1
Claude Opus 4.7 Maxopen-redirectmediumserver.js:2185 of 5Unsanitized input from an HTTP parameter flows into redirect, where it is used as input for request redirection. This may result in an Open Redirect vulnerability.1
Claude Opus 4.7 Maxssrfhighserver.js:1395 of 5Unsanitized input from the HTTP request body flows into fetch, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability.1
Claude Sonnet 4.6 Highallocation-of-resources-without-limits-or-throttlingmediumserver.js:1763 of 5Expensive operation (a file system operation) is performed by an endpoint handler which does not use a rate-limiting mechanism. It may enable the attackers to perform Denial-of-service attacks. Consider using a rate-limiting middleware such as express-limit.1
Claude Sonnet 4.6 Highallocation-of-resources-without-limits-or-throttlingmediumserver.js:1861 of 5Expensive operation (a file system operation) is performed by an endpoint handler which does not use a rate-limiting mechanism. It may enable the attackers to perform Denial-of-service attacks. Consider using a rate-limiting middleware such as express-limit.1
Claude Sonnet 4.6 Highcommand-injectionhighserver.js:1245 of 5Unsanitized input from the HTTP request body flows into promisified command execution function, where it is used to build a shell command. This may result in a Command Injection vulnerability.1
Claude Sonnet 4.6 Highcsrfmediumserver.js:175 of 5CSRF protection is disabled for your Express app. This allows the attackers to execute requests on a user's behalf.1
Claude Sonnet 4.6 Highhardcoded-credentialshighserver.js:335 of 5Avoid hardcoding values that are meant to be secret. Found a hardcoded string used in express-session.1
Claude Sonnet 4.6 Highinformation-exposuremediumserver.js:172 of 5Disable X-Powered-By header for your Express app (consider using Helmet middleware), because it exposes information about the used framework to potential attackers.1
Claude Sonnet 4.6 Highinformation-exposurelowserver.js:375 of 5Cookie has the Secure attribute set to false. Set it to true to protect the cookie from man-in-the-middle attacks.1
Claude Sonnet 4.6 Highopen-redirectmediumserver.js:2185 of 5Unsanitized input from an HTTP parameter flows into redirect, where it is used as input for request redirection. This may result in an Open Redirect vulnerability.1
Claude Sonnet 4.6 Highssrfhighserver.js:1395 of 5Unsanitized input from the HTTP request body flows into fetch, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability.1
Claude Sonnet 4.6 Mediumallocation-of-resources-without-limits-or-throttlingmediumserver.js:1764 of 5Expensive operation (a file system operation) is performed by an endpoint handler which does not use a rate-limiting mechanism. It may enable the attackers to perform Denial-of-service attacks. Consider using a rate-limiting middleware such as express-limit.1
Claude Sonnet 4.6 Mediumcommand-injectionhighserver.js:1245 of 5Unsanitized input from the HTTP request body flows into promisified command execution function, where it is used to build a shell command. This may result in a Command Injection vulnerability.1
Claude Sonnet 4.6 Mediumcsrfmediumserver.js:175 of 5CSRF protection is disabled for your Express app. This allows the attackers to execute requests on a user's behalf.1
Claude Sonnet 4.6 Mediumhardcoded-credentialshighserver.js:335 of 5Avoid hardcoding values that are meant to be secret. Found a hardcoded string used in express-session.1
Claude Sonnet 4.6 Mediumimproper-type-validationlowserver.js:851 of 5The type of this object, coming from body and the value of its trim property can be controlled by the user. An attacker may craft the properties of the object to crash the application or bypass its logic. Consider checking the type of the object.1
Claude Sonnet 4.6 Mediuminformation-exposuremediumserver.js:175 of 5Disable X-Powered-By header for your Express app (consider using Helmet middleware), because it exposes information about the used framework to potential attackers.1
Claude Sonnet 4.6 Mediuminformation-exposurelowserver.js:375 of 5Cookie has the Secure attribute set to false. Set it to true to protect the cookie from man-in-the-middle attacks.1
Claude Sonnet 4.6 Mediumopen-redirectmediumserver.js:2185 of 5Unsanitized input from an HTTP parameter flows into redirect, where it is used as input for request redirection. This may result in an Open Redirect vulnerability.1
Claude Sonnet 4.6 Mediumssrfhighserver.js:1395 of 5Unsanitized input from the HTTP request body flows into fetch, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability.1

Finding evidence

Unmatched normalized signatures

Unmatched reports may be false-positive-shaped, adjacent, or likely product-gap candidates.

Severity and description show the deterministic most-frequent metadata variant; the final column records how many variants were observed across repetitions.

ConfigurationClassRepresentative severityLocationRecurrenceRepresentative descriptionMetadata variants
Claude Opus 4.6 Highinsecure-transportlowserver.js:371 of 5Session cookie is configured with secure:false and no sameSite attribute, allowing session cookies to be transmitted over unencrypted HTTP and included in cross-site requests.1
Claude Opus 4.6 Highinsecure-transportlowserver.js:383 of 5Session cookie is configured with secure: false, allowing it to be transmitted over unencrypted HTTP connections where it can be intercepted by network attackers.3
Claude Opus 4.6 Mediuminsecure-transportlowserver.js:383 of 5Session cookie has secure: false, allowing it to be transmitted over unencrypted HTTP connections, exposing session tokens to network interception.3
Claude Opus 4.7 Maxinsecure-transportmediumserver.js:385 of 5Session cookie configured with `secure: false` and no `httpOnly`/`sameSite` flags, allowing cookie transmission over plain HTTP and exposure to JavaScript/CSRF.5
Claude Opus 4.7 Maxotherlowserver.js:362 of 5express-session configured with saveUninitialized:true, creating sessions for unauthenticated visitors and increasing attack surface for session fixation and storage exhaustion.2
Claude Opus 4.7 Maxredoslowserver.js:804 of 5Hostname regex uses nested quantifiers ([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)* allowing potentially catastrophic backtracking on crafted inputs; bounded but still costly.4
Claude Sonnet 4.6 Highcommand-injectioncriticalserver.js:753 of 5All three regex patterns in isSafePingHost() (IPv4 at line 75, IPv6 at line 77, hostname at line 79-81) lack end anchors ($). The patterns only check that the string starts with a valid value, allowing arbitrary shell-injectable content to follow (e.g., '1.1.1.1; rm -rf /' passes the IPv4 check).3
Claude Sonnet 4.6 Highcommand-injectioncriticalserver.js:801 of 5The hostname regex in isSafePingHost is missing a `$` end anchor, so inputs like `example.com; id` pass validation and can be injected into the shell command constructed in runPing.1
Claude Sonnet 4.6 Highinformation-exposurelowindex.hbs:81 of 5The server's OS hostname (`os.hostname()`) is rendered on the public home page, leaking internal infrastructure naming that could assist an attacker in reconnaissance.1
Claude Sonnet 4.6 Highinsecure-transportmediumserver.js:385 of 5Session cookie is configured with secure: false, allowing transmission over plain HTTP and exposing it to network interception. The cookie also lacks a sameSite attribute, and maxAge is set to ~3 years (99999999999 ms), creating extremely long-lived sessions.5
Claude Sonnet 4.6 Highopen-redirecthighserver.js:2151 of 5Missing `return` after `res.redirect(302, '/')` inside the protective if-block in the /visitPage handler. Execution always falls through to `res.redirect(target)` on line 218, making the safety check completely ineffective and the open redirect unconditional.1
Claude Sonnet 4.6 Highothermediumserver.js:2161 of 5Missing return after res.redirect(302, '/') at line 216. Execution always falls through to res.redirect(target) at line 218. When the safety condition is met (target === '/visitPage'), two response calls are made, causing a 'headers already sent' crash and allowing the redirect to target to also fire, defeating the guard.1
Claude Sonnet 4.6 Highprototype-pollutionmediumserver.js:1431 of 5HTTP response headers from a remote (potentially attacker-controlled) server are assigned into a plain `{}` object without filtering reserved keys. If the remote server returns a header named `__proto__`, `constructor`, or `prototype`, the assignment `headers[key] = value` can pollute the JavaScript object prototype chain.1
Claude Sonnet 4.6 Mediumcommand-injectioncriticalserver.js:754 of 5All three host-validation regexes in isSafePingHost() — IPv4 (/^(\d{1,3}\.){3}\d{1,3}/), IPv6 (/^[0-9a-fA-F:]+/), and hostname — are missing a `$` end anchor. JavaScript's RegExp.test() returns true when only a prefix of the string matches, so attackers append shell metacharacters (`;`, `&&`, `|`, `$()`, etc.) after a valid prefix to bypass the check entirely.4
Claude Sonnet 4.6 Mediumcommand-injectioncriticalserver.js:773 of 5IPv6 regex `/^[0-9a-fA-F:]+/` in `isSafePingHost` has no end anchor `$`, so inputs like `::1; rm -rf /` pass validation and are later embedded in the shell ping command.3
Claude Sonnet 4.6 Mediumcommand-injectioncriticalserver.js:791 of 5The hostname regex in isSafePingHost is not anchored at the end (missing $), so 'example.com; evil_command' matches and passes validation, enabling command injection in runPing.1
Claude Sonnet 4.6 Mediumcommand-injectioncriticalserver.js:802 of 5Hostname regex in `isSafePingHost` has no end anchor `$`, allowing inputs such as `example.com && whoami` to pass host validation and be executed as shell commands via `execAsync`.2
Claude Sonnet 4.6 Mediuminformation-exposurelowserver.js:1811 of 5Internal server hostname (os.hostname()) is exposed in the index, account, and results pages. This leaks internal infrastructure naming conventions and may assist attackers in reconnaissance or targeted attacks.1
Claude Sonnet 4.6 Mediuminsecure-transportmediumserver.js:385 of 5Session cookie is configured with `secure: false`, allowing the session token to be transmitted over unencrypted HTTP connections where it can be intercepted. The cookie also has an extremely long `maxAge` (~3 years), prolonging the window for stolen sessions.5
Claude Sonnet 4.6 Mediumopen-redirecthighserver.js:2111 of 5The safety guard inside `/visitPage` (`if (!target || target === '/visitPage' ...)`) is missing a `return` statement, so execution always falls through to the unvalidated `res.redirect(target)` call, making the guard ineffective.1
Claude Sonnet 4.6 Mediumotherlowserver.js:361 of 5saveUninitialized: true causes a session to be created and stored for every unauthenticated request, which wastes server-side storage and creates unnecessary session tokens that can be abused.1
Claude Sonnet 4.6 Mediumotherlowserver.js:392 of 5Session cookie maxAge is set to 99999999999 milliseconds (~3155 years), effectively creating permanent sessions and increasing the window for session hijacking if a token is compromised.2
Claude Sonnet 4.6 Mediumssrfhighserver.js:1401 of 5The fetch call uses redirect:'follow', meaning if a public HTTPS URL responds with a redirect pointing to an internal/private address, the server silently follows the chain and exposes internal resources. Combined with the absence of private-IP filtering, this enables redirect-based SSRF even when the initial hostname looks public.1

Model behavior

Recurrence by configuration

Stable recurrence measures repeated behavior, not independent validity.

ConfigurationMatched signaturesMatched all fiveUnmatched signaturesUnmatched all five
Claude Opus 4.6 High5420
Claude Opus 4.6 Medium4410
Claude Opus 4.7 Max10731
Claude Sonnet 4.6 High9671
Claude Sonnet 4.6 Medium97101

Inspectable source context

Reference locations

Apache-licensed fixture excerpts are shown around declared reference lines. They are evidence, not runnable examples.

server.js:85js-improper-type-validation-5

function parseTarget(raw) {
  const input = (raw || '').trim();
  if (!input) return { error: 'Target is required.' };
server.js:37js-cookie-secure-flag-false-5
    resave: false,
    saveUninitialized: true,
    cookie: {
      secure: false,
      maxAge: 99999999999,
server.js:17js-csrf-missing-5
const startedAt = Date.now();

const app = express();

app.engine(
server.js:17js-xpowered-by-header-5
const startedAt = Date.now();

const app = express();

app.engine(
server.js:176js-alloc-without-limits-5a
});

app.get('/', (req, res) => {
  res.render('index', {
    title: 'Health check',
server.js:186js-alloc-without-limits-5b
});

app.get('/account', (req, res) => {
  let lastPingLabel = 'n/a';
  if (req.session.lastPingOk === true) lastPingLabel = 'yes';
server.js:221js-alloc-without-limits-5c
});

app.post('/check', async (req, res, next) => {
  try {
    const parsed = parseTarget(req.body.target);
server.js:218js-open-redirect-5
    res.redirect(302, '/');
  }
    res.redirect(target);
});
server.js:124js-command-injection-5
  const cmd = `ping -c 4 -W 5 ${host}`;
  try {
    const { stdout, stderr } = await execAsync(cmd, {
      timeout: 25000,
      maxBuffer: 512 * 1024,
server.js:33js-hardcoded-secret-5

app.use(
  session({
    secret: 'viuvsubvsdaf2392379y8239h2r3ifubviufbv',
    resave: false,
server.js:139js-ssrf-5

async function fetchSecurityTxtMeta(securityTxtUrl) {
  const res = await fetch(securityTxtUrl, {
    redirect: 'follow',
    headers: { Accept: 'text/plain,*/*' },

Interpretation boundary

Inspect divergence before classifying it

Unmatched reports may be false-positive-shaped, adjacent to the release reference scope, or likely valid product-gap candidates. Missed reference findings may expose representative-versus-systematic coverage behavior.

Return to explorer evidence