};
const app = express();
app.use(express.urlencoded({ extended: true }));
app.use(express.json());JS 1.0 · Project evidence
JS App: Find Vulnerabilities 1
Express.js app for benchmark testing
Project purpose and scale
JS App: Find Vulnerabilities 1
Express.js app for benchmark testing
- Source files
- 1
- Reference findings
- 7
- Matched signatures
- 25
- Unmatched signatures
- 11
Reference context
Deterministic reference findings
These findings define the project reference set for JS 1.0. Their presence does not establish exhaustive ground truth.
| Class | Severity | Location | Reference ID |
|---|---|---|---|
| information-exposure | medium | app.js:13 | js-xpowered-by-header-1 |
| hardcoded-credentials | high | app.js:9 | js-hardcoded-creds-1 |
| allocation-of-resources-without-limits-or-throttling | medium | app.js:34 | js-allocation-of-resources-without-limits-or-throttling-1 |
| allocation-of-resources-without-limits-or-throttling | medium | app.js:43 | js-allocation-of-resources-without-limits-or-throttling-2 |
| xss | high | app.js:31 | js-xss-1 |
| path-traversal | high | app.js:37 | js-path-traversal-1 |
| command-injection | critical | app.js:45 | js-cmd-injection-1 |
Finding evidence
Reference-matched normalized signatures
Matched means agreement with the Snyk Code reference set, not independent ground-truth adjudication.
Severity and description show the deterministic most-frequent metadata variant; the final column records how many variants were observed across repetitions.
| Configuration | Class | Representative severity | Location | Recurrence | Representative description | Metadata variants |
|---|---|---|---|---|---|---|
| Claude Opus 4.6 High | command-injection | critical | app.js:45 | 5 of 5 | User-controlled req.query.host concatenated into shell command passed to exec() | 1 |
| Claude Opus 4.6 High | hardcoded-credentials | high | app.js:9 | 5 of 5 | Hardcoded database password in DB_CONFIG object | 1 |
| Claude Opus 4.6 High | path-traversal | high | app.js:37 | 5 of 5 | User-controlled req.query.filename appended to base path without normalization | 1 |
| Claude Opus 4.6 High | xss | high | app.js:31 | 5 of 5 | Unsanitized req.query.name interpolated directly into HTML response | 1 |
| Claude Opus 4.6 Medium | command-injection | critical | app.js:45 | 5 of 5 | User-controlled req.query.host concatenated into shell command passed to exec() | 1 |
| Claude Opus 4.6 Medium | hardcoded-credentials | high | app.js:9 | 5 of 5 | Hardcoded database password in DB_CONFIG object | 1 |
| Claude Opus 4.6 Medium | path-traversal | high | app.js:37 | 5 of 5 | User-controlled req.query.filename appended to base path without normalization | 1 |
| Claude Opus 4.6 Medium | xss | high | app.js:31 | 5 of 5 | Unsanitized req.query.name interpolated directly into HTML response | 1 |
| Claude Opus 4.7 Max | command-injection | critical | app.js:45 | 5 of 5 | User-controlled req.query.host concatenated into shell command passed to exec() | 1 |
| Claude Opus 4.7 Max | hardcoded-credentials | high | app.js:9 | 5 of 5 | Hardcoded database password in DB_CONFIG object | 1 |
| Claude Opus 4.7 Max | information-exposure | medium | app.js:13 | 1 of 5 | X-Powered-By header exposes information about the used framework to potential attackers | 1 |
| Claude Opus 4.7 Max | path-traversal | high | app.js:37 | 5 of 5 | User-controlled req.query.filename appended to base path without normalization | 1 |
| Claude Opus 4.7 Max | xss | high | app.js:31 | 5 of 5 | Unsanitized req.query.name interpolated directly into HTML response | 1 |
| Claude Sonnet 4.6 High | allocation-of-resources-without-limits-or-throttling | medium | app.js:34 | 2 of 5 | Expensive operation (a file system operation) is performed by an endpoint handler which does not use a rate-limiting mechanism. It may enable the attackers to perform Denial-of-service attacks. Consider using a rate-limiting middleware such as express-limit. | 1 |
| Claude Sonnet 4.6 High | command-injection | critical | app.js:45 | 5 of 5 | User-controlled req.query.host concatenated into shell command passed to exec() | 1 |
| Claude Sonnet 4.6 High | hardcoded-credentials | high | app.js:9 | 5 of 5 | Hardcoded database password in DB_CONFIG object | 1 |
| Claude Sonnet 4.6 High | information-exposure | medium | app.js:13 | 2 of 5 | X-Powered-By header exposes information about the used framework to potential attackers | 1 |
| Claude Sonnet 4.6 High | path-traversal | high | app.js:37 | 5 of 5 | User-controlled req.query.filename appended to base path without normalization | 1 |
| Claude Sonnet 4.6 High | xss | high | app.js:31 | 5 of 5 | Unsanitized req.query.name interpolated directly into HTML response | 1 |
| Claude Sonnet 4.6 Medium | allocation-of-resources-without-limits-or-throttling | medium | app.js:34 | 2 of 5 | Expensive operation (a file system operation) is performed by an endpoint handler which does not use a rate-limiting mechanism. It may enable the attackers to perform Denial-of-service attacks. Consider using a rate-limiting middleware such as express-limit. | 1 |
| Claude Sonnet 4.6 Medium | command-injection | critical | app.js:45 | 5 of 5 | User-controlled req.query.host concatenated into shell command passed to exec() | 1 |
| Claude Sonnet 4.6 Medium | hardcoded-credentials | high | app.js:9 | 5 of 5 | Hardcoded database password in DB_CONFIG object | 1 |
| Claude Sonnet 4.6 Medium | information-exposure | medium | app.js:13 | 2 of 5 | X-Powered-By header exposes information about the used framework to potential attackers | 1 |
| Claude Sonnet 4.6 Medium | path-traversal | high | app.js:37 | 5 of 5 | User-controlled req.query.filename appended to base path without normalization | 1 |
| Claude Sonnet 4.6 Medium | xss | high | app.js:31 | 5 of 5 | Unsanitized req.query.name interpolated directly into HTML response | 1 |
Finding evidence
Unmatched normalized signatures
Unmatched reports may be false-positive-shaped, adjacent, or likely product-gap candidates.
Severity and description show the deterministic most-frequent metadata variant; the final column records how many variants were observed across repetitions.
| Configuration | Class | Representative severity | Location | Recurrence | Representative description | Metadata variants |
|---|---|---|---|---|---|---|
| Claude Opus 4.6 High | sql-injection | critical | app.js:24 | 5 of 5 | User-supplied 'username' query parameter is directly concatenated into a SQL query string without parameterization or sanitization, allowing SQL injection attacks. | 4 |
| Claude Opus 4.6 High | xss | medium | app.js:47 | 5 of 5 | Output from the exec command is embedded directly in HTML <pre> tags without escaping, which could allow XSS if the command output contains HTML/script content. | 5 |
| Claude Opus 4.6 Medium | sql-injection | critical | app.js:24 | 5 of 5 | User-supplied 'username' query parameter is directly concatenated into a SQL query string without sanitization or parameterized queries, allowing SQL injection. | 3 |
| Claude Opus 4.6 Medium | xss | medium | app.js:47 | 5 of 5 | Output of the ping command (which includes user-controlled 'host' input) is rendered in HTML inside a <pre> tag without escaping, enabling reflected XSS. | 5 |
| Claude Opus 4.7 Max | insecure-transport | medium | app.js:56 | 1 of 5 | Server listens over plain HTTP without TLS, exposing all traffic (including any credentials/session data) to interception. | 1 |
| Claude Opus 4.7 Max | sql-injection | critical | app.js:24 | 5 of 5 | SQL injection in /users endpoint: req.query.username is concatenated directly into SQL string without parameterization or sanitization. | 5 |
| Claude Opus 4.7 Max | xss | medium | app.js:47 | 4 of 5 | Command stdout (influenced by user input) is reflected into HTML via <pre>${stdout}</pre> without escaping, enabling XSS in addition to the command injection. | 4 |
| Claude Sonnet 4.6 High | sql-injection | critical | app.js:24 | 5 of 5 | The 'username' query parameter is concatenated directly into a SQL string without parameterization or escaping: "SELECT * FROM users WHERE username = '" + username + "'". An attacker can inject arbitrary SQL (e.g., ' OR '1'='1) to bypass authentication or exfiltrate data. | 5 |
| Claude Sonnet 4.6 High | xss | high | app.js:47 | 4 of 5 | The stdout output from the exec() call is embedded into an HTML <pre> block and sent to the client without HTML escaping. Combined with the command injection on line 45, an attacker can inject commands that produce output containing malicious HTML/JavaScript tags, resulting in stored or reflected XSS. | 4 |
| Claude Sonnet 4.6 Medium | sql-injection | critical | app.js:24 | 5 of 5 | The 'username' query parameter is concatenated directly into a raw SQL string without parameterization or escaping. An attacker can manipulate the query to dump, modify, or delete data (e.g., username=' OR '1'='1). | 5 |
| Claude Sonnet 4.6 Medium | xss | medium | app.js:47 | 4 of 5 | The /ping endpoint injects raw command stdout directly into an HTML response inside a <pre> tag without HTML-encoding. If the output or a crafted error message contains HTML/script content, it can result in XSS. | 4 |
Model behavior
Recurrence by configuration
Stable recurrence measures repeated behavior, not independent validity.
| Configuration | Matched signatures | Matched all five | Unmatched signatures | Unmatched all five |
|---|---|---|---|---|
| Claude Opus 4.6 High | 4 | 4 | 2 | 2 |
| Claude Opus 4.6 Medium | 4 | 4 | 2 | 2 |
| Claude Opus 4.7 Max | 5 | 4 | 3 | 1 |
| Claude Sonnet 4.6 High | 6 | 4 | 2 | 1 |
| Claude Sonnet 4.6 Medium | 6 | 4 | 2 | 1 |
Inspectable source context
Reference locations
Apache-licensed fixture excerpts are shown around declared reference lines. They are evidence, not runnable examples.
host: "localhost",
user: "admin",
password: "supersecretpassword123",
database: "users_db",
};});
app.get("/file", (req, res) => {
const filename = req.query.filename;
const basePath = "/var/app/public/";});
app.get("/ping", (req, res) => {
const host = req.query.host;
exec("ping -c 1 " + host, (err, stdout, stderr) => {app.get("/greet", (req, res) => {
const name = req.query.name;
res.send(`<html><body><h1>Hello, ${name}!</h1></body></html>`);
});
const filename = req.query.filename;
const basePath = "/var/app/public/";
fs.readFile(basePath + filename, "utf8", (err, data) => {
if (err) return res.status(404).send("Not found");
res.send(data);app.get("/ping", (req, res) => {
const host = req.query.host;
exec("ping -c 1 " + host, (err, stdout, stderr) => {
if (err) return res.status(500).send("Error");
res.send(`<pre>${stdout}</pre>`);Interpretation boundary
Inspect divergence before classifying it
Unmatched reports may be false-positive-shaped, adjacent to the release reference scope, or likely valid product-gap candidates. Missed reference findings may expose representative-versus-systematic coverage behavior.
Return to explorer evidence