juice-shop/juice-shop free scan: 26 vulnerable dependencies, 1 committed secret

juice-shop/juice-shop ↗ · 1618a61 · Aug 21, 2026, 11:04 PM

Hard evidence: 16 issues need attention now.

Free scan · deterministic evidence only

1 committed secret and 15 critical dependency vulnerabilities found. 11 more dimensions need Audit for the full picture.

387 of 1300 files scanned (29%) — this snapshot was truncated: this audit's size limit was reached, so some source was left unread.

What this means

Two scanners read 387 of 1300 files, starting with the highest-priority ones: one for committed credentials, one for known vulnerabilities in your dependencies. They found 1 committed credential on production paths and 15 high or critical vulnerabilities in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep AI is the tier that issues a verdict. This scan does not.

Read it:

Secrets committed on production paths

1 found · 1 file

secretGeneric hardcoded secretfrontend/src/app/login/login.component.ts:63

public testingPasswo…ing'

Packages you ship with known vulnerabilities

15 found · 10 packages

cvenpm multer3 in 1 version

1.4.5-lts.1 — GHSA-44fp-w29j-9vj5, GHSA-4pg4-qvpc-4q3h, GHSA-5528-5vmv-3xc2

Multer vulnerable to Denial of Service via memory leaks from unclosed streams — HIGH

Multer vulnerable to Denial of Service from maliciously crafted requests — HIGH

Multer Vulnerable to Denial of Service via Uncontrolled Recursion — HIGH

cvenpm js-yaml2 in 1 version

3.14.0 — GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj

js-yaml: YAML merge-key chains can force quadratic CPU consumption — HIGH

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — HIGH

cvenpm jsonwebtoken2 in 1 version

0.4.0 — GHSA-8cf7-32gw-wr33, GHSA-c7hr-j4mj-j2w6

jsonwebtoken unrestricted key type could lead to legacy keys usage — HIGH

Verification Bypass in jsonwebtoken — CRITICAL

cvenpm sequelize2 in 1 version

6.37.3 — GHSA-6457-6jrx-69cr, GHSA-v8fg-2rw7-q452

Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type — HIGH

Sequelize: SQL Injection (Oracle DB) — CRITICAL

cvenpm @angular/common@22.0.1GHSA-jhpw-976m-542j

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning — HIGH

cvenpm express-jwt@0.1.3GHSA-6g6m-m6h5-w9gf

Authorization bypass in express-jwt — HIGH

cvenpm glob@10.4.5GHSA-5j98-mcp5-4vw2

glob CLI: Command injection via -c/--cmd executes matches with shell:true — HIGH

cvenpm lodash-es@4.17.21GHSA-r5fr-rjxr-66jc

lodash vulnerable to Code Injection via `_.template` imports key names — HIGH

cvenpm marsdb@0.6.11GHSA-5mrr-rgp6-x4gr

Command Injection in marsdb — CRITICAL

cvenpm sanitize-html@1.4.2GHSA-cgfm-xwp7-2cvr

Sanitize-html Vulnerable To REDoS Attacks — HIGH

Worth knowing, not blocking

77 found · 18 files · 9 packages · 66 in tests

Context only — test/example secrets, dev-only or moderate/low CVEs. Never verdict-forcing.

test fixtureGeneric hardcoded secret63 in 17 files

frontend/src/app/oauth/oauth.component.spec.ts:91, :98

:91 — expect(userService.save).toHaveBeenCalledWith({ email: 'test@test.com', passwo…A==', passwordRepeat: 'bW9jLnRzZXRAdHNldA==' }) — non-production path

:98 — expect(userService.login).toHaveBeenCalledWith({ email: 'test@test.com', passwo…A==', oauth: true }) — non-production path

frontend/src/app/Services/two-factor-auth-service.spec.ts:68

:68 — expect(req.request.body).toEqual({ password: 's3cr3t!', initialToken:…ken', setupToken: 'setupToken' }) — non-production path

frontend/src/app/two-factor-auth/two-factor-auth.component.spec.ts:243

:243 — twoFactorAuthService.status.mockReturnValue(of({ setup: false, email: 'e', secret…ret', setupToken: 't' })) — non-production path

test/api/2fa.test.ts:42, :66, :85, :104, :123, :141, :142, :156, :182, :214, :240, :257, :266, :291, :292, :317, :352, :379, :412

:42 — const totpToken = generateSync({ secret…3KH' }) — non-production path

:66 — const totpToken = generateSync({ secret…X4H' }) — non-production path

:85 — const totpToken = generateSync({ secret…3KH' }) — non-production path

:104 — const totpToken = generateSync({ secret…3KH' }) — non-production path

:123 — const totpToken = generateSync({ secret…3KH' }) — non-production path

:141 — passwo…EN!', — non-production path

:142 — totpSecret…3KH' — non-production path

:156 — passwo…6lB' — non-production path

:182 — const secret…ML7' — non-production path

:214 — const secret…ML7' — non-production path

:240 — const secret…ML7' — non-production path

:257 — initialToken: generateSync({ secret…QOJ' }) — non-production path

:266 — const secret…ML7' — non-production path

:291 — const passwo…EN!' — non-production path

:292 — const totpSecret…3KH' — non-production path

:317 — const secret…ML7' — non-production path

:352 — const totpSecret…ML7' — non-production path

:379 — const totpSecret…ML7' — non-production path

:412 — totpSecret…ML7' — non-production path

test/api/basket.test.ts:114, :170

:114 — passwo…mI=' — non-production path

:170 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

test/api/chat.test.ts:261

:261 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

test/api/data-export.test.ts:53, :73, :90, :110

:53 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

:73 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

:90 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

:110 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

test/api/delivery.test.ts:54, :115

:54 — passwo…bJb' — non-production path

:115 — passwo…bJb' — non-production path

test/api/deluxe.test.ts:25, :40, :85, :128, :165

:25 — passwo…or!' — non-production path

:40 — passwo…bJb' — non-production path

:85 — passwo…or!' — non-production path

:128 — passwo…...' — non-production path

:165 — passwo…bJb' — non-production path

test/api/erasure-request.test.ts:36, :55, :68, :82, :94, :106

:36 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

:55 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

:68 — .send({ email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

:82 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

:94 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

:106 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

test/api/feedback.test.ts:117, :143

:117 — passwo…mI=' — non-production path

:143 — passwo…mI=' — non-production path

test/api/login.test.ts:90, :118, :132, :147, :245, :267

:90 — passwo…F$P' — non-production path

:118 — passwo…...' — non-production path

:132 — passwo…EN!' — non-production path

:147 — passwo…mI=' — non-production path

:245 — passwo…mI=' — non-production path

:267 — passwo…mI=' — non-production path

test/api/password.test.ts:95

:95 — passwo…or!' — non-production path

test/api/product-review.test.ts:101, :115

:101 — passwo…mI=' — non-production path

:115 — passwo…mI=' — non-production path

test/api/user-profile.test.ts:58

:58 — const { token } = await login(app, { email: 'ciso@juice-sh.op', passwo…bJb' }) — non-production path

test/api/user.test.ts:189, :240, :289, :304, :318

:189 — passwo…ter' — non-production path

:240 — passwo…mI=' — non-production path

:289 — passwo…mI=' — non-production path

:304 — passwo…mI=' — non-production path

:318 — passwo…mI=' — non-production path

test/cypress/e2e/changePassword.spec.ts:6, :25, :31

:6 — passwo…nce' — non-production path

:25 — passwo…or!' — non-production path

:31 — cy.login({ email: 'bender', passwo…sic' }) — non-production path

test fixtureJSON Web Token3 in 2 files

frontend/src/app/last-login-ip/last-login-ip.component.spec.ts:72, :78

:72 — localStorage.setItem('token', 'eyJhbG…t3bg') — non-production path

:78 — localStorage.setItem('token', 'eyJhbG…enLw') — non-production path

test/api/user.test.ts:280

:280 — .set({ Authorization: 'eyJhbG…pC8g' }) — non-production path

moderate cvenpm lodash-es2 in 1 version

4.17.21 — GHSA-f23m-r3pf-42rh, GHSA-xxjr-mmjv-4gpg

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` — MODERATE

Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions — MODERATE

moderate cvenpm sanitize-html2 in 1 version

1.4.2 — GHSA-3j7m-hmh3-9jmp, GHSA-mjxr-4v3x-q3m4

Cross-Site Scripting in sanitize-html — MODERATE

Improper Input Validation in sanitize-html — MODERATE

low cvenpm body-parser@1.20.4GHSA-v422-hmwv-36x6

body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement — LOW

moderate cvenpm file-type@16.5.4GHSA-5v7r-6r5c-r473

file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header — MODERATE

moderate cvenpm js-yaml@3.14.0GHSA-h67p-54hq-rp68

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases — MODERATE

moderate cvenpm jsonwebtoken@0.4.0GHSA-hjrf-2m68-5959

jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC — MODERATE

moderate cvenpm morgan@1.10.0GHSA-4vj7-5mj6-jm8m

morgan vulnerable to Log Forging via unneutralized control characters in :remote-user — MODERATE

moderate cvenpm notevil@1.3.3GHSA-8g4m-cjm2-96wq

Sandbox escape in notevil and argencoders-notevil — MODERATE

moderate cvenpm socket.io@3.1.2GHSA-25hc-qcg6-38wj

socket.io has an unhandled 'error' event — MODERATE

AI audit · juice-shop/juice-shop · 14 dimensions · usually within 15 minutes*

Audit — your first Audit is free. After that, about $5.Needs a free GitHub or Google sign-inThe free scan stays unlimited

14 things unaudited

Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.

The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.

SecurityPriority: Core

Privacy & CompliancePriority: Core

Reliability & ResiliencePriority: Core

Code Quality & ArchitecturePriority: Important

AI / Vibe Coding RiskPriority: Important

Performance & ScalabilityPriority: Important

Infrastructure & DevOpsPriority: Important

Data LayerPriority: Important

Business & Product RiskPriority: Supporting

Developer ExperiencePriority: Supporting

Accessibility & UXPriority: Supporting

ObservabilityPriority: Supporting

Maintainability ForecastPriority: Specialized

IP & Novelty ExposurePriority: Specialized

Modules run (2)

Hardcoded Secret ScanDependency Vulnerability Scan

Hover a module for why it was selected. See every check nittim can run.

Scanned 387 of 1300 files (highest-priority subset) · juice-shop/juice-shop
Dependency manifests: 2 package roots found, 2 scanned.

README badge

nittim verdict badge for juice-shop/juice-shop

[![nittim](https://nittim.com/api/badge/juice-shop/juice-shop)](https://nittim.com/library/juice-shop/juice-shop)