OWASP NodeGoat
Express + MongoDB app demonstrating OWASP Top 10 vulnerabilities in Node.js.
- Upstream: https://github.com/OWASP/NodeGoat
- Pinned commit:
c5cb68a7084e4ae7dcc60e6a98768720a81841e8 - Reference: master HEAD 2026-05-17
- Baseline scan date: 2026-05-17
Vulnerabilities brass detects
These are the specific lines brass catches in this codebase. Re-running brass at the pinned commit reproduces each one. 8 required findings:
| File | Line | Category | Detected by | CWE / Bandit ID |
|---|---|---|---|---|
app/routes/contributions.js | 32 | code_injection | JavaScriptTypeScriptScanner | Server-Side JS Injection via eval() (CWE-95) |
app/routes/contributions.js | 33 | code_injection | JavaScriptTypeScriptScanner | Server-Side JS Injection via eval() (CWE-95) |
app/routes/contributions.js | 34 | code_injection | JavaScriptTypeScriptScanner | Server-Side JS Injection via eval() (CWE-95) |
artifacts/db-reset.js | 18 | hardcoded_credential | JavaScriptTypeScriptScanner | Hardcoded Credentials (CWE-798) |
artifacts/db-reset.js | 27 | hardcoded_credential | JavaScriptTypeScriptScanner | Hardcoded Credentials (CWE-798) |
artifacts/db-reset.js | 35 | hardcoded_credential | JavaScriptTypeScriptScanner | Hardcoded Credentials (CWE-798) |
app/routes/session.js | 61 | hardcoded_credential | SecretsScanner | Hardcoded Credentials (CWE-798) |
app/routes/session.js | 172 | hardcoded_credential | SecretsScanner | Hardcoded Credentials (CWE-798) |
Documented vulnerabilities brass doesn’t yet catch
Honest list of gaps — vulnerabilities documented upstream but missed by brass’s current scanner set. We publish these so customers see the full picture, not just successes. 4 aspirational entries:
| File | Line | Category | What brass doesn’t catch yet |
|---|---|---|---|
app/data/allocations-dao.js | 73 | nosql_injection | A1: NoSQL Injection via $where with template literal |
app/data/allocations-dao.js | 78 | nosql_injection | A1: NoSQL Injection via $where with string concat |
app/routes/research.js | 15 | ssrf | A8/A9: SSRF via needle.get(req.query.url) |
app/routes/research.js | 25 | xss | A7: Reflected XSS via res.write of remote body |
Reproduce locally
git clone https://github.com/OWASP/NodeGoat.git project
cd project && git checkout c5cb68a7084e4ae7dcc60e6a98768720a81841e8
brasscoders --offline scan .Then check .brass/detailed_analysis.yaml for the listed findings.