{
  "schema_version": "codestax-public-evidence/v1",
  "kind": "recorded_scan_extract",
  "recorded_at": "2026-10-23T17:43:22.762018Z",
  "repository": "juice-shop/juice-shop",
  "repository_revision": "717f5efa886b0417eeecb52378b03cf10567b7e2",
  "product_revision": "0ef00eba5e5c1ee897f1b00e761b360fa13c0bf1",
  "harness_version": "1.0.0",
  "sources": [
    {
      "artifact": "evaluation/results/2026-10-23/juice_shop.findings.json",
      "sha256": "5b4d403d4b9f9e57f2fab3fd3603712b1c313ca8662750b2fbb4f01e999f5a39"
    },
    {
      "artifact": "evaluation/results/2026-10-23/juice_shop.results.json",
      "sha256": "7cec9d94dd4f6c3cf16a9cbb949ff5171f54046cba65084e5433ec9e096c9163"
    }
  ],
  "scope": "Historical CodeStax evaluation of a deliberately vulnerable public training repository. Not a customer scan, current accuracy guarantee, live GitHub integration test or independent certification.",
  "analyzer": "SAST Analyzer",
  "analyzer_version": "1.168.0",
  "finding": {
    "rule_id": "yaml.github-actions.security.run-shell-injection.run-shell-injection",
    "file": "github/workflows/update-challenges-ebook.yml",
    "line": 22,
    "severity": "critical",
    "cwes": [
      78
    ],
    "message": "Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use ",
    "analysis_method": "pattern"
  },
  "source_path": ".github/workflows/update-challenges-ebook.yml",
  "source_url": "https://github.com/juice-shop/juice-shop/blob/717f5efa886b0417eeecb52378b03cf10567b7e2/.github/workflows/update-challenges-ebook.yml#L21-L25",
  "coverage_status": "degraded",
  "coverage_warning": "Partial SAST coverage; 23 files could not be fully parsed: corpora/juice_shop/.github/workflows/ci.yml, corpora/juice_shop/.github/workflows/frontend-bundle-analysis.yml and 21 more; 1 rule timeout on: corpora/juice_shop/frontend/src/assets/private/three.js",
  "limits": "The normalized finding path drops the leading dot in .github. The location starts the run block; interpolation is at line 25. Push triggers restrict branches to master/develop; workflow_dispatch also exists. This pattern warning is not proof of attacker control, exploitability, a posted GitHub check or a tested fix. The recorded message is truncated in the normalized source artifact."
}