Description

Detects unsafe dynamic module imports in Express.js applications that could lead to path traversal or remote code execution vulnerabilities. This occurs when modules are loaded using variables or user-controlled input without proper validation, allowing potential access to arbitrary files on the system.

Detection Strategy

• Application must be using the Express.js framework

• Identifies module imports using dynamic/variable sources (e.g., require(variable) or import(variable))

• Checks if the import source is potentially controllable by user input

• Validates that the import is not properly sanitized or restricted to safe paths

• Reports vulnerability when dynamic imports are found without proper path validation or sanitization

Vulnerable code example

const express = require('express');
const app = express();

app.post('/dynamic-import', async (req, res) => {
    const userModule = req.query.module;
    // VULNERABLE: Unsanitized user input used in dynamic import
    const mod = await import(userModule);
});...

✅ Secure code example

const express = require('express');
const app = express();

app.post('/dynamic-import', async (req, res) => {
    const userModule = req.query.module;
    
    // SECURE: Whitelist of allowed modules with their full paths
        'logger': './modules/logger.js',...