Intentionally vulnerable JavaScript Code Snippets which are intended to benchmark Static Application Security Testing tools.
Do not use any of this code in production.
Each folder contains one main.js with exactly one intended weakness. Client-side snippets run in the browser, server-side snippets are minimal Express apps. Dependencies are only referenced via require and are not installed, which is sufficient for static analysis.
| CWE | Name | Context | Weakness |
|---|---|---|---|
| CWE-20 | Improper Input Validation | Client | Suffix check returns true if the suffix is one character longer than the input |
| CWE-22 | Path Traversal | Server | req.query.file is joined into a file path, ../ escapes the upload folder |
| CWE-78 | OS Command Injection | Server | req.query.host is interpolated into a shell command |
| CWE-79 | Cross-site Scripting (DOM) | Client | URL parameter is written to innerHTML |
| CWE-80 | Basic XSS | Client | HTML is only inserted if it contains a <script> tag |
| CWE-89 | SQL Injection | Server | req.query.category is concatenated into an SQL query |
| CWE-95 | Eval Injection | Client | URL fragment is passed to eval |
| CWE-117 | Log Injection | Server | Unsanitized user name is logged, newlines forge log entries |
| CWE-209 | Information Exposure Through an Error Message | Server | Stack trace is sent to the client |
| CWE-256 | Plaintext Storage of a Password | Client | Password is stored in localStorage |
| CWE-258 | Empty Password in Configuration File | Server | Admin login succeeds with an empty password |
| CWE-259 | Use of Hard-coded Password | Client | Bearer token is hard-coded |
| CWE-312 | Cleartext Storage of Sensitive Information | Client | Credit card number is stored in a cookie |
| CWE-327 | Use of a Broken Cryptographic Algorithm | Server | Credit card number is encrypted with DES-ECB |
| CWE-330 | Use of Insufficiently Random Values | Client | Reset token is generated with Math.random() |
| CWE-338 | Use of Cryptographically Weak PRNG | Client | Password is generated with Math.random() |
| CWE-352 | Cross-Site Request Forgery | Server | State-changing POST request relies on cookies without a CSRF token |
| CWE-502 | Deserialization of Untrusted Data | Server | Cookie is deserialized with node-serialize |
| CWE-561 | Dead Code | Client | Unreachable branch skips the ban check |
| CWE-563 | Assignment to Variable without Use | Client | Sanitized input is unused, raw input goes to innerHTML |
| CWE-601 | Open Redirect | Server | req.query.returnUrl is used as redirect target |
| CWE-611 | XML External Entity | Server | XML is parsed with entity expansion enabled |
| CWE-614 | Sensitive Cookie Without 'Secure' Attribute | Server | Session cookie is sent over HTTP |
| CWE-834 | Excessive Iteration | Client | Loop bound is taken from the API response |
| CWE-916 | Weak Password Hash | Server | Password is hashed with MD5 |
| CWE-918 | Server-Side Request Forgery | Server | Server fetches req.query.url |
| CWE-942 | Permissive CORS Policy | Server | Any origin is reflected with credentials allowed |
| CWE-943 | NoSQL Injection | Server | Request body is used as MongoDB query, {"$ne": null} bypasses login |
| CWE-1022 | Untrusted Link Target | Client | window.open without noopener |
| CWE-1321 | Prototype Pollution | Client | Recursive merge copies __proto__ from parsed JSON |
| CWE-1333 | Inefficient Regular Expression (ReDoS) | Client | Nested quantifier causes catastrophic backtracking |