
Synthetic demo target for EXPOSURE — CVE-2018-21268 (traceroute) + CVE-2018-3757 (pdf-image)
This repository is a synthetic demo target for Endor Labs EXPOSURE.
CVE-2018-21268 — traceroute command injection via the host argument. Exploitable in this baseline (no input validation). No upstream fix.CVE-2018-3757 — pdf-image command injection via the file-path argument. Not exploitable in this baseline (the /render route regex-validates the path before constructing PDFImage). No upstream fix.src/main.js for a hardened variant that
adds a strict hostname regex before traceroute.trace, closing the
compensating-control lane — without upgrading the vulnerable dependency.This repo is not a production application. It exists only to anchor the EXPOSURE "click → real PR opens" demo against a real GitHub repository.