node-vulnerable

This repository is a synthetic demo target for Endor Labs EXPOSURE.

• The current state is deliberately exploitable. EXPOSURE will report an exploitable verdict against it.
• Tracked CVEs:
  • CVE-2018-21268 — traceroute command injection via the host argument. Exploitable in this baseline (no input validation). No upstream fix.
  • CVE-2018-3757 — pdf-image command injection via the file-path argument. Not exploitable in this baseline (the /render route regex-validates the path before constructing PDFImage). No upstream fix.
• A demo PR opened by EXPOSURE swaps src/main.js for a hardened variant that adds a strict hostname regex before traceroute.trace, closing the compensating-control lane — without upgrading the vulnerable dependency.
• The customer effort to apply the fix is one click (review + merge).

This repo is not a production application. It exists only to anchor the EXPOSURE "click → real PR opens" demo against a real GitHub repository.