- Repository:
juice-shop/juice-shop - Commit:
1618a611b173b4bf114028e6e02549950606e29d - Method: source-only review; no running instance
- Ground truth: the project calls itself intentionally insecure in its README and separates challenge behavior from unexpected vulnerabilities in SECURITY.md.
confirmed, CWE-89: the login route interpolates request email into a SQL string before passing
it to Sequelize. The source marks the expression as a vulnerable challenge line:
routes/login.ts#L32-L35.
The repository also supplies its own correct remediation: bind both email and the hashed password instead of constructing query syntax from user input: loginAdminChallenge_4_correct.ts#L14-L17. Its explanation explicitly rejects a custom blocklist and identifies binding as the effective control: loginAdminChallenge.info.yml#L1-L9.
This is a confirmed vulnerable code path but not applicable as an undisclosed upstream security
report: it is intentional challenge behavior. Treating every challenge hit as a new project defect
would violate the target's threat model and inflate precision.
One confirmed challenge does not measure coverage across Juice Shop's full challenge inventory, prove the CLI finds SQL injection automatically, or establish safety of any deployed instance.