Code Security Report: 1 high severity findings, 4 total findings [master]

[mend-for-github-com]

Code Security Report

Scan Metadata

Latest Scan: 2025-06-29 11:47am
Total Findings: 4 | New Findings: 0 | Resolved Findings: 0
Tested Project Files: 70
Detected Programming Languages: 1 (JavaScript / TypeScript*)

• Check this box to manually trigger a scan

Finding Details

Severity	Vulnerability Type	CWE	File	Data Flows	Detected
High	Command Injection	CWE-78	Gruntfile.js:157	1	2025-06-29 11:47am
Vulnerable Code NodeGoat/Gruntfile.js Lines 152 to 157 in 44c6716 var done; done = this.async(); var cmd = process.platform === "win32" ? "NODE_ENV=" + finalEnv + " & " : "NODE_ENV=" + finalEnv + " "; exec( 1 Data Flow/s detected NodeGoat/Gruntfile.js Line 151 in 44c6716 var finalEnv = process.env.NODE_ENV || arg || "development"; NodeGoat/Gruntfile.js Line 155 in 44c6716 var cmd = process.platform === "win32" ? "NODE_ENV=" + finalEnv + " & " : "NODE_ENV=" + finalEnv + " "; NodeGoat/Gruntfile.js Line 158 in 44c6716 cmd + "node artifacts/db-reset.js", NodeGoat/Gruntfile.js Line 157 in 44c6716 exec( Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Command Injection Training ● Videos    ▪ Secure Code Warrior Command Injection Video ● Further Reading    ▪ OWASP testing for Command Injection    ▪ OWASP Command Injection 🏴 Suppress Finding ... as False Alarm ... as Acceptable Risk
Medium	Hardcoded Password/Credentials	CWE-798	profile-test.js:25	4	2025-06-29 11:47am
Vulnerable Code NodeGoat/test/security/profile-test.js Line 25 in 44c6716 var zaproxy = new ZapClient(zapOptions); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Hardcoded Password/Credentials Training ● Videos    ▪ Secure Code Warrior Hardcoded Password/Credentials Video 🏴 Suppress Finding ... as False Alarm ... as Acceptable Risk
Medium	Hardcoded Password/Credentials	CWE-798	profile-test.js:37	1	2025-06-29 11:47am
Vulnerable Code NodeGoat/test/security/profile-test.js Line 37 in 44c6716 var sutUserPassword = "User1_123"; Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Hardcoded Password/Credentials Training ● Videos    ▪ Secure Code Warrior Hardcoded Password/Credentials Video 🏴 Suppress Finding ... as False Alarm ... as Acceptable Risk
Low	Sensitive Cookie Without Secure	CWE-614	server.js:78	1	2025-06-29 11:47am
Vulnerable Code NodeGoat/server.js Lines 73 to 78 in 44c6716 // Mandatory in Express v4 extended: false })); // Enable session management using express middleware app.use(session({ 1 Data Flow/s detected NodeGoat/server.js Line 78 in 44c6716 app.use(session({ Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Sensitive Cookie Without Secure Training ● Videos    ▪ Secure Code Warrior Sensitive Cookie Without Secure Video 🏴 Suppress Finding ... as False Alarm ... as Acceptable Risk