Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice?

Name: Snyk VulnBench JS 1.0 dataset
Creator: Snyk
Published: 2026-06-11
License: https://www.apache.org/licenses/LICENSE-2.0

Liran Tal; Johannes Kloos; Arsenii Rudich; Stephen Thoemmes; Manoj Nair

JS 1.0 · Project evidence

JS Snippet (Redirect Handoff): Find Vulnerabilities

Small Express workspace handoff service with redirect and cross-origin response handling.

Open filtered findings All representative cases

Project purpose and scale

JS Snippet (Redirect Handoff): Find Vulnerabilities

Small Express workspace handoff service with redirect and cross-origin response handling.

Source files: 2
Reference findings: 4
Matched signatures: 17
Unmatched signatures: 4

Reference context

Deterministic reference findings

These findings define the project reference set for JS 1.0. Their presence does not establish exhaustive ground truth.

Class	Severity	Location	Reference ID
insecure-transport	medium	app.js:5	jsg-insecure-transport-1
open-redirect	medium	app.js:18	jsg-open-redirect-1
open-redirect	medium	app.js:21	jsg-open-redirect-2
origin-validation-error	medium	app.js:10	jsg-cors-1

Finding evidence

Reference-matched normalized signatures

Matched means agreement with the Snyk Code reference set, not independent ground-truth adjudication.

Severity and description show the deterministic most-frequent metadata variant; the final column records how many variants were observed across repetitions.

Configuration	Class	Representative severity	Location	Recurrence	Representative description	Metadata variants
Claude Opus 4.6 High	open-redirect	medium	app.js:18	5 of 5	A user-controlled query parameter is passed directly to res.redirect.	1
Claude Opus 4.6 High	open-redirect	medium	app.js:21	5 of 5	A route parameter is used to build a protocol-relative redirect URL.	1
Claude Opus 4.6 High	origin-validation-error	medium	app.js:10	5 of 5	The service reflects request origin data into Access-Control-Allow-Origin while allowing credentials.	1
Claude Opus 4.6 Medium	open-redirect	medium	app.js:18	5 of 5	A user-controlled query parameter is passed directly to res.redirect.	1
Claude Opus 4.6 Medium	open-redirect	medium	app.js:21	5 of 5	A route parameter is used to build a protocol-relative redirect URL.	1
Claude Opus 4.6 Medium	origin-validation-error	medium	app.js:10	5 of 5	The service reflects request origin data into Access-Control-Allow-Origin while allowing credentials.	1
Claude Opus 4.7 Max	open-redirect	medium	app.js:18	5 of 5	A user-controlled query parameter is passed directly to res.redirect.	1
Claude Opus 4.7 Max	open-redirect	medium	app.js:21	5 of 5	A route parameter is used to build a protocol-relative redirect URL.	1
Claude Opus 4.7 Max	origin-validation-error	medium	app.js:10	5 of 5	The service reflects request origin data into Access-Control-Allow-Origin while allowing credentials.	1
Claude Sonnet 4.6 High	insecure-transport	medium	app.js:5	3 of 5	The handoff service is created with a plaintext HTTP server.	1
Claude Sonnet 4.6 High	open-redirect	medium	app.js:18	5 of 5	A user-controlled query parameter is passed directly to res.redirect.	1
Claude Sonnet 4.6 High	open-redirect	medium	app.js:21	5 of 5	A route parameter is used to build a protocol-relative redirect URL.	1
Claude Sonnet 4.6 High	origin-validation-error	medium	app.js:10	5 of 5	The service reflects request origin data into Access-Control-Allow-Origin while allowing credentials.	1
Claude Sonnet 4.6 Medium	insecure-transport	medium	app.js:5	3 of 5	The handoff service is created with a plaintext HTTP server.	1
Claude Sonnet 4.6 Medium	open-redirect	medium	app.js:18	5 of 5	A user-controlled query parameter is passed directly to res.redirect.	1
Claude Sonnet 4.6 Medium	open-redirect	medium	app.js:21	5 of 5	A route parameter is used to build a protocol-relative redirect URL.	1
Claude Sonnet 4.6 Medium	origin-validation-error	medium	app.js:10	5 of 5	The service reflects request origin data into Access-Control-Allow-Origin while allowing credentials.	1

Finding evidence

Unmatched normalized signatures

Unmatched reports may be false-positive-shaped, adjacent, or likely product-gap candidates.

Severity and description show the deterministic most-frequent metadata variant; the final column records how many variants were observed across repetitions.

Configuration	Class	Representative severity	Location	Recurrence	Representative description	Metadata variants
Claude Opus 4.7 Max	csrf	medium	app.js:11	5 of 5	Access-Control-Allow-Credentials is enabled together with a reflected/wildcard-like Access-Control-Allow-Origin, enabling cross-site authenticated requests against this service with no CSRF protections in place.	5
Claude Sonnet 4.6 High	csrf	high	app.js:11	2 of 5	Setting Access-Control-Allow-Credentials: true alongside a dynamically reflected (any) Access-Control-Allow-Origin header means cross-site requests can include cookies and HTTP authentication credentials. There is no CSRF token or other same-site request validation, so any origin can perform credentialed state-changing requests on behalf of authenticated users.	2
Claude Sonnet 4.6 High	information-exposure	low	app.js:25	2 of 5	The /status endpoint returns the internal service name ('silvergate') and its operational status in a JSON response without any authentication. This leaks service fingerprinting information that aids attacker reconnaissance.	2
Claude Sonnet 4.6 High	origin-validation-error	high	app.js:10	1 of 5	The fallback value 'null' for Access-Control-Allow-Origin (when no Origin header is present) is dangerous. Browsers assign a null origin to sandboxed iframes (e.g., <iframe sandbox="allow-scripts" src="data:...">) and local files. Combined with Access-Control-Allow-Credentials: true, this allows an attacker page to craft a sandboxed iframe that makes credentialed cross-origin requests which bypass CORS checks.	1

Model behavior

Recurrence by configuration

Stable recurrence measures repeated behavior, not independent validity.

Configuration	Matched signatures	Matched all five	Unmatched signatures	Unmatched all five
Claude Opus 4.6 High	3	3	0	0
Claude Opus 4.6 Medium	3	3	0	0
Claude Opus 4.7 Max	3	3	1	1
Claude Sonnet 4.6 High	4	3	3	0
Claude Sonnet 4.6 Medium	4	3	0	0

Inspectable source context

Reference locations

Apache-licensed fixture excerpts are shown around declared reference lines. They are evidence, not runnable examples.

app.js:5jsg-insecure-transport-1


const app = express();
const server = http.createServer();

app.disable("x-powered-by");

app.js:18jsg-open-redirect-1


  if (target) {
    return res.redirect(target);
  }

app.js:21jsg-open-redirect-2

  }

  return res.redirect("//" + req.params.workspace);
});

app.js:10jsg-cors-1


server.on("request", (req, res) => {
  res.setHeader("Access-Control-Allow-Origin", req.headers.origin || "null");
  res.setHeader("Access-Control-Allow-Credentials", true);
});

Interpretation boundary

Inspect divergence before classifying it

Unmatched reports may be false-positive-shaped, adjacent to the release reference scope, or likely valid product-gap candidates. Missed reference findings may expose representative-versus-systematic coverage behavior.

Return to explorer evidence