juice-shop

No entries match these filters. Clear filters

1. v20.3.0 Oct 11, 2026 · issue 104

   juice-shop v20.3.0 adds alternateImages config, AVIFAVIFAn open image format based on the AV1 video codec, maintained by the Alliance for Open Media, offering smaller file sizes than JPEG or PNG at comparable quality — useful when a tool serves image-heavy web interfaces. product images, and Farsi and Tamil language support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v20.3.0 https://github.com/juice-shop/juice-shop.git
   # already have the repo? check out this version:
   $ git checkout v20.3.0

   └──▷ USE IT
   Serve modern AVIF images at multiple resolutions for a custom product by declaring alternateImages in your instance configuration.
   yaml copy

   alternateImages:
     - format: avif
       density: 1x
       path: /assets/public/images/products/my-product.avif
     - format: avif
       density: 2x
       path: /assets/public/images/products/my-product@2x.avif
     - format: avif
       density: 3x
       path: /assets/public/images/products/my-product@3x.avif

   • Adds optional alternateImages configuration property to define alternative product image formats and densities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds responsive AVIF product images across 1x, 2x, and 3x display densities.
   • Adds optional alternateImages configuration property to define alternative product image formats and densities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

2. api-docs-86f7c62a8474 Oct 11, 2026 · issue 102

   Adds NextGen B2B API v2.0.0 at /b2b/v2 with a JSON-based POST /orders endpoint replacing legacy XML endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   Adds NextGen B2B API v2.0.0 at `/b2b/v2` with a JSON-based `POST /orders` endpoint replacing legacy XML endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • ⚠ description: 'New & secure JSON-based API for our enterprise customers. (Deprecates previously offered XML-based endpoints)'
   └──▷ GET THIS VERSION

   copy

   $ git clone --branch api-docs-86f7c62a8474 https://github.com/juice-shop/juice-shop.git
   # already have the repo? check out this version:
   $ git checkout api-docs-86f7c62a8474

   └──▷ TRY IT
   Place a new customer order via the B2B API using a JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. token and structured order lines.
   copy

   $ curl -X POST https://<host>/b2b/v2/orders \
     -H 'Authorization: Bearer <jwt_token>' \
     -H 'Content-Type: application/json' \
     -d '{"cid": "JS0815DE", "orderLines": [{"productId": 8, "quantity": 500, "customerReference": "PO0000001"}]}'

   Submit an order using the customer-specific orderLinesData free-form JSON string field instead of structured orderLines.
   copy

   $ curl -X POST https://<host>/b2b/v2/orders \
     -H 'Authorization: Bearer <jwt_token>' \
     -H 'Content-Type: application/json' \
     -d '{"cid": "JS0815DE", "orderLinesData": "[{\"productId\": 12,\"quantity\": 10000,\"customerReference\": [\"PO0000001.2\",\"SM20180105|042\"],\"couponCode\": \"pes[Bh.u*t\"}]"}'

   • Adds POST /b2b/v2/orders endpoint (createCustomerOrder) accepting a JSON Order body (requiring cid, optional orderLines / orderLinesData) and returning an OrderConfirmation with cid, orderNo, and paymentDue (date, 14-day terms); secured with JWT Bearer auth.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces the NextGen B2B API v2.0.0 at base path /b2b/v2, a JSON-based enterprise ordering API that deprecates the previously offered XML-based endpoints.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Deprecation notice: description: 'New & secure JSON-based API for our enterprise customers. (Deprecates previously offered XML-based endpoints)'
3. api-docs-d99d1c6c03dd Oct 8, 2026 · issue 097

   Juice Shop adds a NextGen B2B REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. at /b2b/v2 with JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. bearer auth, replacing XML-based order endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   Juice Shop adds a NextGen B2B REST API at `/b2b/v2` with JWT bearer auth, replacing XML-based order endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • ⚠ New & secure JSON-based API for our enterprise customers. (Deprecates previously offered XML-based endpoints)
   └──▷ GET THIS VERSION

   copy

   $ git clone --branch api-docs-d99d1c6c03dd https://github.com/juice-shop/juice-shop.git
   # already have the repo? check out this version:
   $ git checkout api-docs-d99d1c6c03dd

   └──▷ TRY IT
   Place a structured customer order against the new B2B v2 API using a JWT bearer tokenbearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else..
   copy

   $ curl -X POST https://<host>/b2b/v2/orders \
     -H 'Authorization: Bearer <jwt>' \
     -H 'Content-Type: application/json' \
     -d '{"cid": "JS0815DE", "orderLines": [{"productId": 8, "quantity": 500, "customerReference": "PO0000001"}]}'

   Submit order lines in a customer-specific JSON string format using the orderLinesData field instead of the structured array.
   copy

   $ curl -X POST https://<host>/b2b/v2/orders \
     -H 'Authorization: Bearer <jwt>' \
     -H 'Content-Type: application/json' \
     -d '{"cid": "JS0815DE", "orderLinesData": "[{\"productId\": 12,\"quantity\": 10000,\"customerReference\": [\"PO0000001.2\",\"SM20180105|042\"],\"couponCode\": \"pes[Bh.u*t\"}]"}'

   • Adds POST /b2b/v2/orders endpoint (createCustomerOrder) for placing customer orders in JSON format, returning an OrderConfirmation with cid, orderNo, and paymentDue fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces JWT bearer auth (bearerAuth, bearerFormat: JWT) as the security scheme for all B2B v2 endpoints.
   • Supports OrderLinesData schema for submitting order lines in customer-specific JSON string format, alongside the structured OrderLines array.
   • Launches the NextGen B2B API (/b2b/v2) as a JSON-based replacement for the previously offered XML-based B2B endpoints.

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The previously offered XML-based B2B endpoints are deprecated in favour of the new JSON-based /b2b/v2 API; integrations relying on the XML endpoints should migrate.
   • !Deprecation notice: New & secure JSON-based API for our enterprise customers. (Deprecates previously offered XML-based endpoints)
4. api-docs-86f7c62a8474 Sep 14, 2026 · issue 074
   API change

   • ⚠ description: 'New & secure JSON-based API for our enterprise customers. (Deprecates previously offered XML-based endpoints)'
   └──▷ GET THIS VERSION

   copy

   $ git clone --branch api-docs-86f7c62a8474 https://github.com/juice-shop/juice-shop.git
   # already have the repo? check out this version:
   $ git checkout api-docs-86f7c62a8474

   └──▷ TRY IT
   Place a new B2B customer order using a JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. token — returns an order number and payment due date 14 days out.
   copy

   $ curl -X POST https://<host>/b2b/v2/orders \
     -H 'Authorization: Bearer <jwt_token>' \
     -H 'Content-Type: application/json' \
     -d '{"cid": "JS0815DE", "orderLines": [{"productId": 8, "quantity": 500, "customerReference": "PO0000001"}]}'

   └──▷ BREAKING ON UPGRADE

   • !Deprecation notice: description: 'New & secure JSON-based API for our enterprise customers. (Deprecates previously offered XML-based endpoints)'
5. api-docs-86f7c62a8474 Sep 13, 2026 · issue 073

   juice-shop adds a NextGen B2B REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. at /b2b/v2 replacing XML-based endpoints, with JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. bearer auth and JSON order management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   juice-shop adds a NextGen B2B REST API at `/b2b/v2` replacing XML-based endpoints, with JWT bearer auth and JSON order management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • ⚠ description: 'New & secure JSON-based API for our enterprise customers. (Deprecates previously offered XML-based endpoints)'
   └──▷ GET THIS VERSION

   copy

   $ git clone --branch api-docs-86f7c62a8474 https://github.com/juice-shop/juice-shop.git
   # already have the repo? check out this version:
   $ git checkout api-docs-86f7c62a8474

   └──▷ TRY IT
   Place a new B2B order using standard order lines — authenticate with a JWT and submit product IDs and quantities to the new JSON endpoint.
   copy

   $ curl -X POST https://<host>/b2b/v2/orders \
     -H 'Authorization: Bearer <jwt_token>' \
     -H 'Content-Type: application/json' \
     -d '{"cid": "JS0815DE", "orderLines": [{"productId": 8, "quantity": 500, "customerReference": "PO0000001"}]}'

   Place a B2B order using the orderLinesData field for a customer-specific JSON format that includes coupon codes.
   copy

   $ curl -X POST https://<host>/b2b/v2/orders \
     -H 'Authorization: Bearer <jwt_token>' \
     -H 'Content-Type: application/json' \
     -d '{"cid": "JS0815DE", "orderLinesData": "[{\"productId\": 12, \"quantity\": 10000, \"customerReference\": [\"PO0000001.2\"], \"couponCode\": \"pes[Bh.u*t\"}]"}'

   • Adds POST /b2b/v2/orders endpoint (operationId: createCustomerOrder) to create customer orders, accepting an Order body with cid, orderLines, and orderLinesData fields and returning an OrderConfirmation with orderNo and paymentDue.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds JWT bearer authentication (bearerAuth, scheme: bearer, format: JWT) as the security scheme for all /b2b/v2 endpoints.
   • Introduces the NextGen B2B JSON API (/b2b/v2, version 2.0.0), replacing the previously offered XML-based B2B endpoints.
   • Supports orderLinesData as a free-form JSON string field on orders, enabling customer-specific order line formats including couponCode alongside standard productId, quantity, and customerReference.

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Deprecation notice: description: 'New & secure JSON-based API for our enterprise customers. (Deprecates previously offered XML-based endpoints)'
6. api-docs-86f7c62a8474 Sep 12, 2026 · issue 072

   juice-shop adds a NextGen B2B JSON API at /b2b/v2 with a POST /orders endpoint secured by JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. bearer auth.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   juice-shop adds a NextGen B2B JSON API at /b2b/v2 with a POST /orders endpoint secured by JWT bearer auth.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • ⚠ description: 'New & secure JSON-based API for our enterprise customers. (Deprecates previously offered XML-based endpoints)'
   └──▷ GET THIS VERSION

   copy

   $ git clone --branch api-docs-86f7c62a8474 https://github.com/juice-shop/juice-shop.git
   # already have the repo? check out this version:
   $ git checkout api-docs-86f7c62a8474

   └──▷ TRY IT
   Place a new B2B customer order using structured order lines — authenticate with a JWT and POST to the new endpoint.
   copy

   $ curl -X POST https://<host>/b2b/v2/orders \
     -H 'Authorization: Bearer <jwt_token>' \
     -H 'Content-Type: application/json' \
     -d '{"cid": "JS0815DE", "orderLines": [{"productId": 8, "quantity": 500, "customerReference": "PO0000001"}]}'

   Submit an order using the customer-specific orderLinesData free-form JSON string field for enterprise integrations with non-standard line formats.
   copy

   $ curl -X POST https://<host>/b2b/v2/orders \
     -H 'Authorization: Bearer <jwt_token>' \
     -H 'Content-Type: application/json' \
     -d '{"cid": "JS0815DE", "orderLinesData": "[{\"productId\": 12,\"quantity\": 10000,\"customerReference\": [\"PO0000001.2\", \"SM20180105|042\"]}]"}'

   • Introduces the OrderLinesData schema for passing order lines in customer-specific JSON format as a raw string, enabling flexible enterprise order integrations alongside the structured OrderLines array format.

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !Deprecation notice: description: 'New & secure JSON-based API for our enterprise customers. (Deprecates previously offered XML-based endpoints)'
7. api-docs-86f7c62a8474 Sep 11, 2026 · issue 071

   juice-shop: Adds JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. bearer authentication (bearerAuth, scheme: bearer, format: JWT) as the security scheme for all /b2b/v2 endpoints.

   API change

   juice-shop: Adds JWT bearer authentication (`bearerAuth`, scheme: bearer, format: JWT) as the security scheme for all `/b2b/v2` endpoints.

   • ⚠ description: 'New & secure JSON-based API for our enterprise customers. (Deprecates previously offered XML-based endpoints)'
   └──▷ GET THIS VERSION

   copy

   $ git clone --branch api-docs-86f7c62a8474 https://github.com/juice-shop/juice-shop.git
   # already have the repo? check out this version:
   $ git checkout api-docs-86f7c62a8474

   └──▷ TRY IT
   Place an enterprise order via the new B2B API using a JWT token, submitting structured order lines with a customer reference.
   copy

   $ curl -X POST https://<host>/b2b/v2/orders \
     -H 'Authorization: Bearer <jwt_token>' \
     -H 'Content-Type: application/json' \
     -d '{"cid": "JS0815DE", "orderLines": [{"productId": 8, "quantity": 500, "customerReference": "PO0000001"}]}'

   Submit customer-specific free-form order lines via the orderLinesData field when the buyer uses a non-standard line format.
   copy

   $ curl -X POST https://<host>/b2b/v2/orders \
     -H 'Authorization: Bearer <jwt_token>' \
     -H 'Content-Type: application/json' \
     -d '{"cid": "JS0815DE", "orderLinesData": "[{\"productId\": 12,\"quantity\": 10000,\"customerReference\": [\"PO0000001.2\",\"SM20180105|042\"]}]"}'

   • Supports an orderLinesData field on Order for customer-specific free-form JSON order lines, alongside the structured orderLines array (each line requiring productId and quantity, with optional customerReference).

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !Deprecation notice: description: 'New & secure JSON-based API for our enterprise customers. (Deprecates previously offered XML-based endpoints)'
8. api-docs-86f7c62a8474 Sep 10, 2026 · issue 070

   juice-shop adds a JSON-based NextGen B2B API at /b2b/v2 with JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. bearer auth and a POST /orders endpoint for enterprise order management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   juice-shop adds a JSON-based NextGen B2B API at /b2b/v2 with JWT bearer auth and a POST /orders endpoint for enterprise order management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • ⚠ description: 'New & secure JSON-based API for our enterprise customers. (Deprecates previously offered XML-based endpoints)'
   └──▷ GET THIS VERSION

   copy

   $ git clone --branch api-docs-86f7c62a8474 https://github.com/juice-shop/juice-shop.git
   # already have the repo? check out this version:
   $ git checkout api-docs-86f7c62a8474

   └──▷ TRY IT
   Place an enterprise order with standard order lines via the new B2B endpoint, authenticated with a JWT bearer tokenbearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else..
   copy

   $ curl -X POST https://<host>/b2b/v2/orders \
     -H 'Authorization: Bearer <jwt-token>' \
     -H 'Content-Type: application/json' \
     -d '{"cid": "JS0815DE", "orderLines": [{"productId": 8, "quantity": 500, "customerReference": "PO0000001"}]}'

   Submit order lines in the customer-specific OrderLinesData JSON string format, including a coupon code and multi-value customer references.
   copy

   $ curl -X POST https://<host>/b2b/v2/orders \
     -H 'Authorization: Bearer <jwt-token>' \
     -H 'Content-Type: application/json' \
     -d '{"cid": "JS0815DE", "orderLinesData": "[{\"productId\": 12,\"quantity\": 10000,\"customerReference\": [\"PO0000001.2\", \"SM20180105|042\"],\"couponCode\": \"pes[Bh.u*t\"},{\"productId\": 13,\"quantity\": 2000,\"customerReference\": \"PO0000003.4\"}]"}'

   • Adds POST /b2b/v2/orders endpoint (createCustomerOrder) that accepts a JSON request body containing cid, orderLines, and orderLinesData fields and returns an OrderConfirmation with orderNo and paymentDue.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Secures the new B2B API with HTTP Bearer authentication using JWT (bearerAuth security scheme), required on all /b2b/v2 routes.
   • Introduces the OrderLinesData schema allowing order lines to be submitted in a customer-specific JSON string format, supporting fields such as couponCode and multi-value customerReference arrays alongside standard productId and quantity.
   • Launches the NextGen B2B API (/b2b/v2, version 2.0.0) as a JSON-based replacement for the previously offered XML-based enterprise endpoints.

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Deprecation notice: description: 'New & secure JSON-based API for our enterprise customers. (Deprecates previously offered XML-based endpoints)'
9. v20.2.0 Aug 10, 2026 · issue 042

   Juice Shop v20.2.0 adds three new challenges, Dice Coefficient cheat detection, and a user profile role field.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v20.2.0 https://github.com/juice-shop/juice-shop.git
   # already have the repo? check out this version:
   $ git checkout v20.2.0

   • Adds allowScripts configuration key to package.json and frontend/package.json.
   • Adds new -challenge Misplaced IaC Files to the challenge set.
   • Adds new -challenge Login Cloud Admin (including coding challenge) to the challenge set.
   • Adds new -challenge Vulnerable Infrastructure (including coding challenge) to the challenge set.
   • Adds cheat detection for source file overlap in challenge submissions using Dice Coefficient similarity scoring.

   +5 more show less

   • Adds role field and deluxe membership link to the user profile page.
   • Upgrades frontend to Angular 22.x and Angular Material 22.x.
   • Replaces Grunt with a custom packaging script (scripts/package.mjs) for the build process.
   • Disables the dangerous Deprecated Interface challenge on Docker/Heroku by default.
   • Supports n-gram similarity checks for the System Prompt Extraction challenge.

   10 details in Everything

10. v20.1.0 Jun 23, 2026 · release notes

    Juice Shop v20.1.0 adds a prompt-injectionprompt-injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. challenge, Node.js 26 support, and a new CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. config option.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v20.1.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v20.1.0

    └──▷ USE IT
    Customize the attack origin used in the CSRF challenge — useful when running Juice Shop behind a reverse proxy or on a non-default hostname.
    yaml copy

    overwriteUrlForCsrfChallenge: 'http://evil.example.com'

    • New System Prompt Extraction challenge: prompt injection attack against the chatbot.
    • Adds a Fix It coding phase for the NFT Takeover challenge.
    • Supports Node.js 26.x as a runtime.
    • Replaces native libxmljs2 with WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers.-based libxml2-wasm, eliminating the native build dependency.
    • Adds overwriteUrlForCsrfChallenge configuration option to customize the attack origin for the CSRF challenge.

    5 details in Everything

11. v20.1.0 Jun 23, 2026 · issue 001

    juice-shop v20.1.0 adds Node.js 26 support, a new prompt-injectionprompt-injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. challenge, and a CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. origin config option.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v20.1.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v20.1.0

    • Supports Node.js 26.x runtime.
    • Switches from native libxmljs2 to WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers.-based libxml2-wasm, eliminating native build dependencies.
    • New three-star challenge: _System Prompt Extraction_ — a prompt injection attack against the chatbot.
    • Adds a Fix It remediation phase for the _NFT Takeover_ coding challenge.
    • New overwriteUrlForCsrfChallenge configuration option to customize the attack origin used in the CSRF challenge.

    5 details in Everything

12. v20.0.0 May 12, 2026 · release notes

    Juice Shop v20 adds AI/LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. injection challenges, guest basket support, new themes, Prometheus LLM metrics, and a ~30% faster startup.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v20.0.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v20.0.0

    └──▷ HOW TO FIND IT
    Enable the new AI challenges by pointing Juice Shop at your LLM/AI endpoint so prompt-injectionprompt-injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. scenarios become available in CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. or training sessions.
    📍See https://howto-llm.owasp-juice.shop/ to configure your LLM endpoint, then start Juice Shop normally — the three AI challenges will appear automatically once the endpoint is reachable.
    • Adds three new AI/LLM challenges — Chatbot Prompt Injection (), Greedy Chatbot Manipulation (), and AI Debugging () — requiring a configured LLM/AI endpoint.
    • Adds Prometheus metrics to track LLM token usage and tool calls (requires LLM endpoint support).
    • New guest basket support lets anonymous users add items and merge their basket on login.
    • Introduces two new UI themes: neon-fire (now the default for CTF configuration) and lime-green.
    • Redesigned Coding Challenge view as a standalone page with improved flow and modern code highlighters.

    +5 more show less

    • Changed product overview to a compact grid layout; applies enhanced grid view and blur effect to the photo wall as well.
    • Optimized startup time by ~30% via lazy-loading and batched startup database inserts.
    • Adds strict enum validation for configuration options including codingChallengesEnabled, hintPlaybackSpeed, and showCountryDetailsInNotifications.
    • Cheat detection now treats direct access to tracking pixels as guaranteed cheating, and loosely coupled challenges no longer trigger cheat scoring based on timing.
    • Docker container image reduced to its smallest size since Juice Shop v8.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Node.js 20.x is no longer supported; upgrade to a newer supported Node.js version before upgrading.
    • !The NLP-based chatbot and its challenges Bully Chatbot and Kill Chatbot have been removed, breaking CTF setups or solution guides that rely on them.
    • !Challenges Mint the Honeypot and Wallet Depletion now require an ALCHEMY_API_KEY environment variable to function.
    • !The Internet Traffic challenge tag has been renamed to External Dependency, which may break customization files or CTF setups referencing the old tag name.
13. v19.2.0 Mar 7, 2026 · release notes

    Juice Shop v19.2.0 adds a new Password Hash Leak challenge, coding challenge expansions, and CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. system-wide notification support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v19.2.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v19.2.0

    └──▷ HOW TO FIND IT
    Integrate MultiJuicer or another CTF platform so its system-wide notifications appear inside Juice Shop for all players.
    📍In your Juice Shop config file, set the CTF notification endpoint to your MultiJuicer notification URL so the UI polls it and displays broadcast messages.
    • Adds new two-star _Password Hash Leak_ challenge for practicing credential exposure scenarios.
    • Adds coding challenges for the _Wallet Depletion_ and _Mint the Honeypot_ challenges.
    • Supports displaying CTF system-wide notifications from MultiJuicer and other CTF systems via a configurable endpoint.
    • Payloads in challenge descriptions on the Score Board can now be copied to clipboard by clicking on them.
    • Language dropdown now includes backend strings in its translation gauge and percentage.

    +4 more show less

    • Adds _Jump to related coding challenge_ button to challenge-solved notifications.
    • Coding challenge flow now auto-scrolls to the _Fix It_ tab when _Find It_ has already been solved.
    • Updated SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation to CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. format; only JSON SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. are now generated (no XML).
    • Official Docker image now uses Node.js 24.x base images.

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The challenges.showFeedbackButtons option has been removed from all configuration files — any customization referencing this key will break on upgrade.
14. v19.1.0 Nov 16, 2025 · release notes

    juice-shop v19.1.0 adds a new Observability Failures challenge category covering logging and monitoring gaps.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v19.1.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v19.1.0

    • New Observability Failures challenge category groups four logging- and monitoring-related challenges for targeted practice.

    1 detail in Everything

15. v19.0.0 Sep 4, 2025 · release notes

    Juice Shop v19 adds Node.js 24 support, Angular 20 upgrade, and a new multi-hint system on the Score Board.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v19.0.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v19.0.0

    • Adds support for Node.js 24.x runtime.
    • Updates frontend to Angular 20.x and Angular Material 20.x.
    • New Score Board feature: gradually unlockable hints per challenge, revealed progressively as players need help.
    • Adds backend and challenge solution webhook support for multiple text hints per challenge.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The hint and hintUrl fields are removed from challenges.yml definition and the corresponding entity model — any customization files or integrations that reference these fields must be updated.
    • !Significant changes to existing challenges may break canned CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. setups and solution guides made for previous versions of OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Juice Shop.
16. v18.0.0 Jun 17, 2025 · release notes

    Juice Shop v18 adds a new Leaked API Key challenge, a DEF CON 33 theme, and a metrics user-agent config option.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v18.0.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v18.0.0

    └──▷ TRY IT
    Run Juice Shop with the DEF CON 33 theme for a themed CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. event.
    copy

    $ NODE_ENV=defcon33 npm start

    • Adds new five-star _Leaked API Key_ challenge for advanced CTF/training scenarios.
    • Adds full-conversion DEF CON 33 theme activatable via NODE_ENV=defcon33 npm start.
    • Adds metricsIgnoredUserAgents config option to control which monitoring agents count toward challenge tracking.
    • Adds ftp/package-lock.json to make Vulnerable Components category challenges more accessible.
    • Switches XML parser from libxmljs to libxmljs2, supporting up to at least Node.js 24.

    +1 more show less

    • Official Docker image now uses Node.js 22.x base images.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Node.js 18.x is no longer supported; packaged distributions for 18.x are no longer provided — upgrade to Node.js 20.x or 22.x before upgrading Juice Shop.
    • !The _Cross-Site Imaging_ challenge now uses https://cataas.com/ instead of http://placecats.com/, which will break existing CTF solution guides and canned setups that reference the old service.
17. v17.3.0 Apr 22, 2025 · release notes

    Juice Shop v17.3.0 adds a searchable language selector and upgrades to Angular 19 and Debian 12.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v17.3.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v17.3.0

    • Adds search functionality to the language selection dropdown for faster language discovery.
    • Upgrades frontend to Angular 19.x and Angular Material 19.x.
    • Updates Docker base image from Debian 11 to Debian 12.

    3 details in Everything

18. v17.2.0 Mar 14, 2025 · release notes

    Juice Shop v17.2.0 adds a new 5-star Memory Bomb challenge, Angular 17 frontend, and BlueSky/Mastodon social config support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v17.2.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v17.2.0

    └──▷ USE IT
    Wire up your Juice Shop instance's About Us page with BlueSky and Mastodon links by adding the new social fields to your config.
    yaml copy

    social:
      blueSkyUrl: "https://bsky.app/profile/yourorg.bsky.social"
      mastodonUrl: "https://infosec.exchange/@yourorg"

    • Adds new _Memory Bomb_ challenge for advanced CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. and training scenarios.
    • Upgrades frontend to Angular 17.x and Angular Material 17.x.
    • Adds blueSkyUrl and mastodonUrl fields to the social section of the configuration.
    • Adds BlueSky and Mastodon profile links to the About Us screen.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The _Cross-Site Imaging_ challenge now uses http://placecats.com instead of http://placekitten.com — canned CTF setups or solution guides relying on the old endpoint will break.
19. v17.1.0 Aug 5, 2024 · release notes

    juice-shop v17.1.0 adds Node.js 22 support and guided tutorials for Admin Section and Reflected XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. challenges.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v17.1.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v17.1.0

    • Adds support for Node.js 22.x runtime.
    • New guided tutorial script for the Admin Section () challenge.
    • New guided tutorial script for the Reflected XSS () challenge.
    • Improved DevTools-open detection in the hacking instructor tutorial helper.

    4 details in Everything

20. v17.0.0 May 24, 2024 · release notes

    Adds the new Security Advisory challenge, reduces Docker image size, and cleans up legacy UI/config.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v17.0.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v17.0.0

    • Adds #2198: Security Advisory-challenge
    • Significantly reduce Docker image size by omitting unneeded dependencies
    • Adjusts image URLs in 7ms theme and extends with photo wall entries and new products

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed legacy Score Board and all related settings and services
    • !Removed re-routing of legacy challenge=<name> parameter
    • !Removed scoreBoard subsection from backup format
    • !Installation from source code on Node.js >20 currently requires C++ binaries to be built during installation
21. v16.0.0 Dec 19, 2023 · release notes

    Juice Shop v16.0.0 adds Node.js 21 support, median cheat scoring, and legacy UI layout options.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v16.0.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v16.0.0

    • Inverted banners and option to switch layouts allows setting the legacy Score Board as default

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed support for Node.js 16.x and packaged distributions for this version
22. v15.3.0 Nov 3, 2023 · release notes

    Adds optional scoreBoard.scoreBoardVersion config key for local backup and new startup validation checks

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v15.3.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v15.3.0

    • Added optional scoreBoard.scoreBoardVersion property to persist/restore score-board-version from browser local storage.
    • Added warning-only startup check for domains being reachable from the server, e.g. https://www.alchemy.com/.

    2 details in Everything

23. v15.2.0 Sep 22, 2023 · release notes

    v15.2.0 adds Internet Traffic challenge tag, coding challenges for Web3Web3A loosely defined model for a decentralized internet built on public blockchains, where applications run via smart contracts rather than centralized servers, giving cyber tools trustless, permissionless data and transaction layers. Sandbox, and Score Board tooltips.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v15.2.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v15.2.0

    • Adds Internet Traffic tag to mark challenges requiring external server calls
    • Shows tag descriptions as tooltips on the Score Board

    2 details in Everything

24. v15.1.0 Sep 8, 2023 · release notes

    juice-shop v15.1.0 adds Web3Web3A loosely defined model for a decentralized internet built on public blockchains, where applications run via smart contracts rather than centralized servers, giving cyber tools trustless, permissionless data and transaction layers. challenge suite, redesigned Score Board, and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v15.1.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v15.1.0

    • https://sepolia.infura.io is now required for Web3 challenges to access deployed smart contracts
    • Adds a fully re-designed Score Board UI with toggle between old and new versions
    • New Web3 challenge suite: Web3 Sandbox, NFT Takeover, Mint the Honey Pot, and Wallet Depletion
    • Adds OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. CycloneDX SBOMs for both backend and frontend components

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The application server now requires outbound Internet access to https://sepolia.infura.io; blocking this URL will break Web3 challenges.
25. v15.0.0 May 19, 2023 · release notes

    v15.0.0 adds Empty User Registration challenge and Node.js 20.x support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v15.0.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v15.0.0

    • Added support for Node.js 20.x runtime
    • Removed support for Node.js 14.x, 19.x, and inofficial Node.js 15.x
    • Added Empty User Registration challenge under the _Improper Input Validation_ category

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Node.js 14.x and 19.x are no longer supported and packaged distributions for these versions are removed.
    • !Inofficial Node.js 15.x support is removed.
26. v14.5.1 Feb 14, 2023 · release notes

    Adds Irish language support and extends Swiss German translations to Juice Shop.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v14.5.1 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v14.5.1

    • Added (Irish) language support
    • Extended (Swiss German) translation coverage

    2 details in Everything

27. v14.5.0 Feb 7, 2023 · release notes

    v14.5.0 adds a Weak Password coding challenge; drops 32-bit ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. Docker support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v14.5.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v14.5.0

    • Adds #1913 Weak Password coding challenge to the Coding Challenges module
    • Removes dedicated 32-bit ARM Docker image due to Node.js 14.x EOL and compatibility issues

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The dedicated Docker image for 32bit ARM processors is removed; users must migrate to a supported architecture or Node.js version.
28. v14.4.0 Jan 4, 2023 · release notes

    Adds application.social.nftUrl config key for customizable NFT URL and upgrades to Angular 15.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v14.4.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v14.4.0

    • Adds application.social.nftUrl configuration property to define the NFT URL used by the frontend (default: https://opensea.io/collection/juice-shop).
    • Continues codes for local backup now retrieve the fallback value from a cookie instead of only server-side storage.
    • Migrated the frontend application to Angular 15.

    3 details in Everything

29. v14.3.0 Sep 24, 2022 · release notes

    Adds Mass Dispel challenge for bulk notification dismissal training

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v14.3.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v14.3.0

    • Added _Mass Dispel_ challenge to teach closing multiple challenge notifications in one go

    1 detail in Everything

30. v14.1.0 Jul 3, 2022 · release notes

    Adds hiring field to security.txt and X-Recruiting header via new application.securityTxt.hiring config key

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v14.1.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v14.1.0

31. v14.0.0 May 7, 2022 · release notes

    Adds configurable tutorial hint playback speed via hackingInstructor.hintPlaybackSpeed; drops Node.js 12/17 support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v14.0.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v14.0.0

    • Adds hackingInstructor.hintPlaybackSpeed config option (values: faster, slower, fast, slow, or normal) to adjust tutorial hint playback speed by ±50% or ±25% respectively.
    • Splits the CI/CD test job into three separate jobs: test (unit tests), api-test (Frisby.js API tests), and coverage-report (Codeclimate merge/upload).

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed support for Node.js 12.x and 17.x, requiring migration to a newer Node.js version.
    • !Vagrant box now exposes the application at http://192.168.56.110 instead of previous IP ranges.
32. v13.2.0 Jan 21, 2022 · release notes

    Adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. Docker image tags and a Refactoring Safety Net command for coding challenges

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v13.2.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v13.2.0

    • Adds latest-arm, snapshot-arm and vX.Y.Z-arm Docker image tags built for linux/arm64 and linux/arm/v7 architectures.
    • Adds npm run rsn command to check for accidental differences in coding challenge code-fix files via the new coding-challenge-rsn CI/CD job.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !latest, snapshot and vX.Y.Z Docker image tags are now only built for linux/amd64 and no longer include ARM support.
33. v13.1.0 Jan 9, 2022 · release notes

    juice-shop v13.1.0 adds Node.js 17.x support and updates Docker base image to Node.js 16.x

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v13.1.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v13.1.0

    • Adds pre-packaged runtime releases for Node.js 17.x
    • Updates default Docker image base from Node.js 14.x to Node.js 16.x

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The official Docker image no longer uses Node.js 14.x as the base, which may affect customizations relying on that specific runtime version.
34. v13.0.0 Nov 22, 2021 · release notes

    Adds challenge feedback via Google Form and allows config-based hints in the Hacking Instructor.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v13.0.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v13.0.0

    • Adds challenges.showFeedbackButtons config key to enable buttons on solved challenges
    • Hacking Instructor tutorials now substitute static values with configurable properties via application.domain
    • Renames challenges.showCodeSnippets to challenges.codingChallengesEnabled

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Drops support for Internet Explorer 11 and legacy browsers requiring EcmaScript 5
    • !The challenges.showCodeSnippets configuration property is renamed to challenges.codingChallengesEnabled
35. v12.11.0 Nov 12, 2021 · release notes

    v12.11.0 adds // vuln-code-snippet neutral-line annotation support and Node.js 16.x provisioning

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v12.11.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v12.11.0

    • Adds support for // vuln-code-snippet neutral-line comments in coding challenge code snippets to mark lines with no impact on verdict.
    • Pre-packs releases for Node.js 16.x runtime.
    • Drops pre-packaged release support for Node.js 15.x.

    3 details in Everything

36. v12.10.0 Oct 3, 2021 · release notes

    v12.10.0 adds cheat detection, accuracy metrics, Prometheus exports, and Grafana panels for coding challenges

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v12.10.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v12.10.0

    • Adds cheat detection for coding challenges (based on solving speed in relation to code snippet length and selectable fix options)
    • Adds accuracy calculation for coding challenges (based on number of failed solving attempts)
    • Adds Prometheus metrics juiceshop_coding_challenges_progress and juiceshop_coding_challenges_accuracy
    • Adds panels for new coding challenge metrics to Grafana dashboard template

    4 details in Everything

37. v12.9.0 Sep 17, 2021 · release notes

    Juice Shop v12.9.0 introduces Coding Challenges with per-line vulnerability selection and database persistence

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v12.9.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v12.9.0

    └──▷ HOW TO FIND IT
    Demonstrate the new per-line vulnerability selection flow in the Coding Challenges interface
    📍Navigate to the Coding Challenges section, select a challenge, click on the specific vulnerable line within the code snippet, and submit your verdict.
    View the updated scoring board which now reflects coding challenge completion status stored in the database
    📍Open the Score Board page in the application UI to see persistence of coding challenge solutions.
    • Coding Challenges now allow selecting and submitting a single vulnerable line for verdict instead of full code snippets
    • Added an additional tab to Coding Challenges for selecting an assumed fix from provided options after correct vulnerability identification
    • Solution status for Coding Challenges is now persisted to the database and displayed on the Score Board
    • Default availability for coding challenges is configurable to appear only after the corresponding hacking challenge is solved

    4 details in Everything

38. v12.8.1 Jun 30, 2021 · release notes

    Adds a new '20th Anniversary Celebration Ticket' product to the OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Juice Shop inventory

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v12.8.1 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v12.8.1

    └──▷ HOW TO FIND IT
    Locate the new OWASP 20th Anniversary ticket in the shop to verify it appears in the catalog.
    📍Search for '20th Anniversary Celebration Ticket' in the OWASP Juice Shop product list
39. v12.8.0 May 24, 2021 · release notes

    New Local File Read challenge added to OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Juice Shop v12.8.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v12.8.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v12.8.0

    • Adds a new Local File Read challenge to the application's security training content

    1 detail in Everything

40. v12.7.0 Apr 11, 2021 · release notes

    Adds Vulnerable Code Snippets challenge feature and exifForBlueprintChallenge config key

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v12.7.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v12.7.0

    • Code Snippet button on Score Board challenges opens a dialog showing source code with vuln-code-snippet markers revealing vulnerable lines

    1 detail in Everything

41. v12.6.0 Feb 7, 2021 · release notes

    Adds experimental cheat detection scoring and webhook fields

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v12.6.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v12.6.0

    • Adds juiceshop_cheat_score Prometheus metric exposing average user cheat likelihood

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The solution webhook payload no longer contains the evidence: null property
42. v12.5.0 Jan 16, 2021 · release notes

    v12.5.0 adds WebAppDefn .config/webapp.yml support and MatSnackBar UI notifications.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v12.5.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v12.5.0

    └──▷ HOW TO FIND IT
    Observe the new toast-based UI feedback for challenge completion events.
    📍In the application interface, complete a challenge to verify Challenge Solved appears as a toast notification.
    • Adds .config/webapp.yml configuration file to define the OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Juice Shop instance using the WebAppDefn specification
    • Replaces previous notification style with MatSnackBar toasts for Challenge Solved and Server Restarted events

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Existing canned CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. setups and solution guides written for previous versions may break due to challenge behavior changes
    • !The default promotion video in the Video XSS challenge is changed to the OWASP Membership ad, invalidating old solution scripts
43. v12.3.0 Dec 19, 2020 · release notes

    v12.3.0 adds RFC-compliant security.txt URLs and Preferred-Languages/Expires fields

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v12.3.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v12.3.0

    • security.txt is now accessible from both URLs officially defined in the corresponding RFC draft
    • security.txt now also contains the Preferred-Languages and Expires properties

    2 details in Everything

44. v12.2.0 Dec 10, 2020 · release notes

    v12.2.0 adds multi-platform Docker images, new chatbot utterances, and ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. .tgz deprecation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v12.2.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v12.2.0

    • Adds support for linux/arm/v7 and linux/arm64 platforms in Docker images alongside linux/amd64
    • Adds new chatbot utterances including the official theme song
    • Reduces fuzzy matching threshold for product price requests to enable multi-match results

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Automatic mirroring of release artifacts to SourceForge is no longer available
    • !Packaged .tgz archives for linux/arm64 are no longer provided in favor of Docker images
45. v12.1.0 Oct 3, 2020 · release notes

    Adds startup and customization time metrics to Prometheus endpoint and Grafana dashboard template

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v12.1.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v12.1.0

    • Added startup time metrics to monitoring/grafana-dashboard.json and the Prometheus endpoint for monitoring

    1 detail in Everything

46. v12.0.0 Sep 9, 2020 · release notes

    Juice Shop v12 adds geo-stalking challenges, support chat, local backup restore, challenge tags column, and ctfFlag webhook property

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v12.0.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v12.0.0

    └──▷ HOW TO FIND IT
    Use the new UI to filter Score Board challenges by specific tags like OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. or Brute Force.
    📍In the browser, navigate to the Score Board page and click the OSINT or Brute Force filter buttons in the Tags column header.
    • Adds _Support Chat_ page with smart bot for customer questions
    • Adds local backup save/restore support to the _Score Board_ for challenge progress and client-side application settings
    • Adds new challenges: _Bully Chatbot_, _Kill Chatbot_, _Meta Geo Stalking_, _Visual Geo Stalking_, and _Poison Null Byte_
    • Adds a _Tags_ column to the _Score Board_ with filter buttons for categories like OSINT, Brute Force, and Good Practice
    • Enforces geoStalkingMetaSecurityQuestion and geoStalkingVisualSecurityAnswer as mandatory properties on memories entries, and requires minimum two memories entries

    +3 more show less

    • Adds application.chatbot subsection to configuration for setting chatbot name, greeting, trainingData, defaultResponse, and avatar
    • Adds challenges.showMitigations property (defaults to true) to control visibility of _Vulnerability Mitigation_ links on the _Score Board_
    • Adds ctfFlag property to webhook payload containing the solved challenge's flag code

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !geoStalkingMetaSecurityQuestion and geoStalkingVisualSecurityAnswer are now mandatory properties on one memories entry; existing configs must add these fields or fail validation
    • !geoStalkingVisualSecurityQuestion and geoStalkingVisualSecurityAnswer are now mandatory properties on one memories entry; existing configs must add these fields or fail validation
    • !A minimum of two memories entries is enforced; configurations with fewer entries will fail or require migration
47. v11.1.1 Jun 18, 2020 · release notes

    OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Juice Shop v11.1.1 adds Armenian language support and Docker build fixes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v11.1.1 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v11.1.1

    • Adds Armenian () language support to the application interface
    • Docker images now run smoke tests before pushing to DockerHub

    2 details in Everything

48. v11.1.0 Jun 14, 2020 · release notes

    v11.1.0 adds OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. Store config sample and quiet mode notification hide.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v11.1.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v11.1.0

    • Adds config/oss.yml full-conversion sample configuration for OpenSecuritySummit Store
    • Challenge-solved notifications are now hidden in quiet configuration

    2 details in Everything

49. v11.0.0 May 27, 2020 · release notes

    Adds challenge solution webhook POST endpoint and products.[#].limitPerUser config key in v11.0.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v11.0.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v11.0.0

    • Adds products.[#].limitPerUser configuration property to limit purchases for regular customers

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Node.js 13.x is no longer supported and packaged distributions for it are removed; upgrade to Node.js 14.x.
    • !Existing CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. setups and solution guides may break due to significant changes in existing challenges.
50. v10.3.0 May 3, 2020 · release notes

    v10.3.0 adds a Grafana dashboard template and release version metric

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.3.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v10.3.0

    • monitoring/grafana-dashboard.json is now included to support single-instance monitoring in Grafana
    • Added the juiceshop_info metric (or similar release version metric) exposing the running instance's version number
    • Challenge metrics are now grouped by category and difficulty instead of only by difficulty

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Prometheus challenge metrics grouping has changed from difficulty to category,difficulty, requiring updates to existing Grafana dashboards or monitoring queries.
51. v10.2.0 Apr 22, 2020 · release notes

    Adds challenges.restrictToTutorialsFirst config property and NODE_ENV=tutorial for progressive learning paths

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.2.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v10.2.0

    └──▷ TRY IT
    Start the service in tutorial-only mode without editing configuration files manually.
    copy

    $ NODE_ENV=tutorial node app.js

    • Added experimental packaged distributions for Linux on Arm64 processors
    • Added new challenges.restrictToTutorialsFirst property to .juice-shop/config.yml that locks all advanced _Score Board_ filters and challenges without tutorials until challenges with tutorials have been solved, unlocking sequentially by difficulty tiers
    • Added tutorial.yml to allow simple usage of restricted tutorial mode via NODE_ENV=tutorial

    3 details in Everything

52. v10.1.0 Mar 28, 2020 · release notes

    Juice Shop v10.1.0 adds direct-link hacking instructor, custom XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. payloads, BASE_PATH env var for subdirectories, and two new challenges

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.1.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v10.1.0

    └──▷ HOW TO FIND IT
    Launch a specific hacking instructor tutorial directly from the browser URL bar.
    📍/#/hacking-instructor?challenge=Score%20Board
    Serve Juice Shop from a sub-directory by setting the environment variable before startup.
    copy

    $ export BASE_PATH=/juice-shop; node app.js

    Override the default bonus payload for the XSS challenge in the configuration file.
    text copy

    challenges:
      xssBonusPayload: "<script>alert('custom')</script>"

    • Adds /#/hacking-instructor?challenge=<challenge name> URL pattern to launch any tutorial via direct link
    • Adds BASE_PATH environment variable to configure sub-directory serving when using relative links
    • Adds challenges.xssBonusPayload configuration property to define a custom payload for the Bonus Payload challenge
    • Adds _Deluxe Fraud_ challenge requiring surreptitious Deluxe Membership acquisition
    • Adds _CSRF_ challenge requiring username change via online HTML editor

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The _Forged JWT_ challenge is now always disabled on Windows, which may break CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. setups relying on it
53. v10.0.0 Mar 1, 2020 · release notes

    New application.social and easterEggPlanet config keys, /metrics endpoint, new challenges, and Hacking Instructor tutorials in v10.0.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.0.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v10.0.0

    └──▷ USE IT
    Customize the Prometheus metric label prefix and configure a GCP OAuth app for login.
    config copy

    application:
      customMetricsPrefix: 'juiceshop'
      googleOAuth:
        client_id: 'your-gcp-client-id.apps.googleusercontent.com'

    Fetch the application's hacking progress and health metrics from the new Prometheus endpoint.
    api copy

    curl http://localhost:3000/metrics

    • Adds application.googleOAuth, application.customMetricsPrefix, and application.social config sections for OAuth, Prometheus metrics prefix, and social links.
    • Adds /metrics HTTP endpoint that exposes functional, hacking progress, and application health metrics to a Prometheus monitor.
    • Adds new Exposed Metrics challenge to find the exposed Prometheus endpoint.
    • Unlocks hiding unavailable challenges on the Score Board via existing challenges configuration keys.
    • Adds tutorials for Privacy Policy, Password Strength, Login Jim, Login Bender, View Basket, and Forged Feedback in the Hacking Instructor.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !application.planetName and application.planetOverlayMap are now located at application.easterEggPlanet.name and application.easterEggPlanet.overlayMap respectively.
    • !showChallengeSolvedNotifications is now challenges.showSolvedNotifications.
    • !showChallengeHints is now challenges.showHints.
    • !Social URLs (twitterUrl, facebookUrl, slackUrl, redditUrl) and pressKitUrl have moved into the application.social section.
54. v9.3.1 Dec 22, 2019 · release notes

    v9.3.1 adds lazy loading for Hacking Instructor and translates PDF/invoice texts

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.3.1 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v9.3.1

    • Makes all order invoice PDF text translatable via new i18n support

    1 detail in Everything

55. v9.3.0 Nov 25, 2019 · release notes

    Juice Shop v9.3.0 adds Cross-Site Imaging challenge, security questions, and new hackingInstructor config section

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.3.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v9.3.0

    • Adds hackingInstructor.isEnabled config key to enable or disable the hacking instructor feature
    • Adds hackingInstructor.avatarImage config key to customize the avatar image for speech bubbles
    • Adds a new Cross-Site Imaging challenge targeting package and cat related vulnerabilities
    • Adds three new security questions available for users to select during registration

    4 details in Everything

56. v9.2.0 Nov 6, 2019 · release notes

    Adds memories config section for initial Photo Wall entries, new Missing Encoding challenge, and demo user.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.2.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v9.2.0

    • Added new demo theme addo.yml to run Juice Shop in an *All Day DevOps* conference look & feel
    • Added password strength indicator and advice on screens *User Registration* and *Forgot Password*
    • Added user demo (Password: demo) with address, credit card and wallet balance for speeding up shopping demos

    3 details in Everything

57. v9.1.3 Oct 18, 2019 · release notes

    Adds demo and preview domains to OAuth redirect targets; completes German backend translations

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.1.3 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v9.1.3

    • Adds demo.owasp-juice.shop and preview.owasp-juice.shop to the allowed OAuth redirect URI list for easier community testing.
    • Completes translation of all backend strings for German () language support.

    2 details in Everything

58. v9.1.1 Oct 14, 2019 · release notes

    Adds config/unsafe.yml to enable safety overrides for dangerous challenges

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.1.1 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v9.1.1

59. v9.1.0 Oct 12, 2019 · release notes

    Juice Shop v9.1.0 adds backend i18n for challenge/ product text and checksum files for archive verification

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.1.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v9.1.0

    • Adds i18n to the backend to provide translations in default.yml configuration for product names, descriptions, challenge hints, and security questions
    • Accompanies pre-packaged archives with a .md checksum file to verify downloads

    2 details in Everything

60. v9.0.0 Aug 26, 2019 · release notes

    v9.0.0 adds accountant role, deluxe membership, order tracking, and new challenges with API/config breaking changes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.0.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v9.0.0

    └──▷ HOW TO FIND IT
    Log in as an accountant to manage inventory stock levels.
    📍Use the new accountant role credentials to access the inventory maintenance screens.
    • application.welcomeBanner.showOnFirstStart, application.welcomeBanner.title, and .message config keys added for banner control
    • New /rest/user/data-export endpoint replaces previous export path
    • Added accountant user role to maintain inventory stock

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !application.gitHubRibbon renamed to application.showGitHubLinks
    • !application.hideWelcomeBanner replaced by application.welcomeBanner subsection
    • !rest/data-export endpoint renamed to rest/user/data-export
61. v8.7.0 Jun 6, 2019 · release notes

    v8.7.0 adds a Hacking Instructor tutorial, Node.js 12 support, REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. pluralization, and UI enhancements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.7.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v8.7.0

    • Adds an interactive Hacking Instructor providing step-by-step guided tutorials for the _Login Admin_ (Basic SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does.) and _XSS Tier 1_ (DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime. XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session.) challenges
    • Adds support for Node.js 12.x on all supported platforms
    • Adds a welcome banner upon initial startup providing context and an info link
    • Enables closing all _challenge solved_-notifications by clicking the close button while holding the Shift key

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The REST API endpoint rest/product has been renamed to rest/products
62. v8.6.2 May 28, 2019 · release notes

    Adds pre-built MacOS (darwin_x64) distributions for Juice Shop

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.6.2 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v8.6.2

    └──▷ TRY IT
    Download the new MacOS binary distribution directly.
    copy

    $ curl -LO https://github.com/juice-shop/juice-shop/releases/download/v8.6.2/juice-shop_v8.6.2_darwin_x64.zip

    └──▷ BREAKING ON UPGRADE

    • !Windows pre-built distribution file pattern changed from previous names to *_win32_x64.zip
63. v8.6.0 May 26, 2019 · release notes

    Adds GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. Compliance Tier 1/2 challenges and an Art. 17 data erasure form to the Privacy & Security section

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.6.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v8.6.0

    • Adds _GDPR Compliance Tier 1_ challenge requiring login with an erased user account
    • Adds _GDPR Compliance Tier 2_ challenge requiring theft of personal data

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removal of private sponsorship service and crypto currency links
64. v8.5.0 Apr 16, 2019 · release notes

    v8.5.0 adds 2FA setup screens, privacy & security menu, GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. data export with CAPTCHA, and multiple new challenges.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.5.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v8.5.0

    └──▷ HOW TO FIND IT
    Enable 2FA for a user account via the new setup screens in the Privacy & Security menu.
    📍Navigate to the Privacy & Security menu in the UI and use the setup screens to enable/disable 2FA for user accounts.
    Request a GDPR data export using the new screen with CAPTCHA validation.
    📍Navigate to the Request Data Export screen and complete the strong CAPTCHA to initiate the download.
    • Added #939 setup screens to enable or disable two-factor authentication (2FA) for user accounts
    • Added #660 initial Request Data Export screen for GDPR compliance which requires a strong CAPTCHA before download
    • Added dedicated Privacy & Security menu for all related user settings and information
    • Added customer loyalty program with simple bonus points calculation

    4 details in Everything

65. v8.4.0 Mar 7, 2019 · release notes

    Juice Shop v8.4.0 adds new challenges (XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., 2FA), overwriteUrlForProductTamperingChallenge config, and hides password in /api/Users responses.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.4.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v8.4.0

    • Adds two new CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. challenges: _XSS Tier 1.5_ on a legacy page and _DLP Failure Tier 2_ focusing on OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. and password sprayingpassword sprayingTrying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password.
    • Adds _DLP Failure Tier 1_ challenge to the capture-the-flag content
    • Adds Two Factor Authentication challenge for verifying MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. bypasses
    • Removes password column from responses returned by /api/Users endpoints
    • Protects the admin section with a new AdminGuard middleware component

    +2 more show less

    • Adds overwriteUrlForProductTamperingChallenge configuration property to customize product tampering challenge behavior
    • Adds application.redditUrl configuration property for social media integration in the UI

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed support for Node.js 9.x
    • !password field is no longer present in responses from /api/Users API endpoints
66. v8.3.0 Jan 16, 2019 · release notes

    Adds Access Log challenge, Enter key submission, and VR premium content in v8.3.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.3.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v8.3.0

    • Adds Access Log challenge requiring retrieval of a server side log file
    • Enables submission of all input forms via the Enter key instead of clicking buttons
    • Delivers actual premium content for the _Premium Challenge when accessed with special VR hardware

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The _CAPTCHA Bypass_ challenge has been renamed to _CAPTCHA Bypass Tier 1_
    • !Difficulty of _Blockchain Tier 1_ challenge increased from 3 to 5 stars
    • !Difficulty of _CAPTCHA Bypass Tier 1_ challenge decreased from 5 to 2 stars
67. v8.2.0 Dec 6, 2018 · release notes

    Juice Shop v8.2.0 adds Tier 1 challenge, splits Bjoern accounts, adds KR/BG translations and press kit link

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.2.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v8.2.0

    • Adds the Reset Bjoern's Password Tier 1 challenge ( difficulty)
    • Splits the _Login Bjoern_ and _Reset Bjoern's Password_ challenges across two user accounts to support Google OAuth flows
    • Adds full Korean () and Bulgarian () translations
    • Adds a button on the _About Us_ page linking to a configurable press kit page

    4 details in Everything

68. v8.0.0 Nov 10, 2018 · release notes

    v8.0.0 adds multiple new challenges, filter toggles to Score Board, and challenges.safetyOverride / application.slackUrl configs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.0.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v8.0.0

    • Adds challenges.safetyOverride config option to enable dangerous challenges like XXEXXEXML External Entity injection, a class of attack against XML parsers that tricks them into fetching external resources or local files, letting an attacker read sensitive data or trigger server-side request forgery. regardless of runtime environment
    • Adds application.slackUrl property to define a Slack server or invite URL
    • Adds filter toggles for solved challenges and challenge categories to Score Board

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Rewrites AngularJS 1.6 frontend in Angular 7.0 and Bootstrap UI in Material Design
    • !Removes Eye Candy challenge
    • !Disables XXE Tier 1 and Tier 2 challenges in Docker and Heroku environments
    • !Replaces <script> payloads for XSS Tier 0 to Tier 5 challenges with <iframe> payloads
    • !Changes application.gitHubRibbon property into a true/false flag
    • !Restricts application.theme allowed properties to bluegrey-lightgreen, blue-lightblue, deeppurple-amber, indigo-pink, pink-bluegrey, purple-green and deeporange-indigo
69. v7.4.0 Jul 12, 2018 · release notes

    Adds Steganography and Supply Chain Attack challenges plus robots.txt support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v7.4.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v7.4.0

    • Added new Steganography Tier 1 challenge

    1 detail in Everything

70. v7.2.0 May 15, 2018 · release notes

    Juice Shop v7.2.0 adds experimental Node.js 10.x support and async file downloads

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v7.2.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v7.2.0

    • Adds experimental support for Node.js 10.x runtime environments.
    • Implements asynchronous downloading of files (custom product images, logos, icons) with error logging.

    2 details in Everything

71. v7.1.0 Apr 26, 2018 · release notes

    Juice Shop v7.1.0 adds XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. Tier 0 challenge and separates CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. configuration into ctf section in config/fbctf.yml.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v7.1.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v7.1.0

    • Introduced config/fbctf.yml which shows a country name and/or flag next to CTF code in notifications (helpful to locate challenges on world map of FBCTF)
    • Added new XSS Tier 0 challenge for a classic reflected attack
    • Extracted separate configuration section ctf for all properties required only when running a CTF event with property ctf.showFlagsInNotifications replacing application.showCtfFlagsInNotifications and adding ctf.showCountryDetailsInNotifications and ctf.countryMap

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Property application.showCtfFlagsInNotifications is removed; use ctf.showFlagsInNotifications instead.
72. v7.0.0 Mar 14, 2018 · release notes

    v7.0.0 adds new configuration keys for challenges and UI customization

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v7.0.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v7.0.0

    • Adds urlForProductTamperingChallenge config key to set the original URL for the product tampering challenge
    • Adds altcoinName config property to configure the currency name for Blockchain challenges
    • Adds planetOverlayMap and planetName config properties to customize easter egg visuals and naming
    • Adds new cookieConsent configuration subsection for the cookie consent banner

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Dropped support for Node.js 6.x
    • !useForProductTamperingChallenge toggle is replaced by urlForProductTamperingChallenge
    • !showGitHubRibbon backport is removed; use gitHubRibbon instead
73. v6.4.0 Jan 27, 2018 · release notes

    v6.4.0 adds RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives./XXEXXEXML External Entity injection, a class of attack against XML parsers that tricks them into fetching external resources or local files, letting an attacker read sensitive data or trigger server-side request forgery./Tier2 challenges, i18n locale path changes, and new sticker provider

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.4.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v6.4.0

    • Adds RCE Tier 2 challenge for a different type of remote code executionremote code executionRemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives.
    • Adds XXE Tier 2 challenge for a DoS-like XML attack
    • Changes i18n file path format from two-letter codes to full locale codes in /app/i18n/*.json
    • Updates _XXS Tier 1-4_ challenges to require <script>alert("XSS")</script> as the attack pattern
    • Adds sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls. for RCE and XEE challenge code to prevent simple DoS attacks

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !i18n translated files moved from two-letter codes (e.g., zh.json) to full locale codes in /app/i18n/ directory, requiring country-specific variants like zh_CN.json or zh_TW.json
74. v6.3.0 Jan 9, 2018 · release notes

    Adds a new 5-star RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. challenge and persists Coupon/Payment panel states in the UI.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.3.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v6.3.0

    • Adds a new challenge for exploiting a gaping RCE vulnerability
    • Panels _Coupon_ and _Payment_ on the _Your Basket_ screen now persist their expanded/collapsed state
    • The score board is now separated into collapsible blocks per difficulty

    3 details in Everything

75. v6.0.0 Dec 2, 2017 · release notes

    v6.0.0 introduces showVersionNumber config, JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store./CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. challenges, and payment UI updates.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.0.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v6.0.0

    • Adds showVersionNumber configuration option to control version visibility
    • Adds Credit Card payment option to the Your Basket screen

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed fallback default value in case fileForRetrieveBlueprintChallenge property was missing in a custom YML configuration
    • !Juice Shop server will now refuse to start if any of useForProductTamperingChallenge, useForChristmasSpecialChallenge and fileForRetrieveBlueprintChallenge are configured on more than one product
76. v5.0.0 Sep 6, 2017 · release notes

    v5.0.0 introduces Product Reviews with separate MongoDB storage and two new challenge categories.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.0.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v5.0.0

    • Adds Product Reviews to the product details dialog with a separate MongoDB storage backend
    • Introduces two new NoSQL Injection challenges (both 3-star)
    • Introduces two new TyposquattingTyposquattingUsing a name close to a trusted domain or software package to catch spelling mistakes. Attackers use it to lure people or installers to a malicious lookalike. challenges (one 3-star, one 4-star)
    • Adds the Known Vulnerable Components challenge category containing Typosquatting and Vulnerable Library challenges

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Drops support for node.js 4.x; only 6.x and 8.x are supported
    • !Docker image tags reduced to latest (from master) and snapshot (from develop)
77. v4.0.0 Jun 25, 2017 · release notes

    v4.0.0 adds security question registration/reset, pomace recycling UX, and awareness training

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.0.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v4.0.0

    └──▷ HOW TO FIND IT
    Demonstrate the new registration flow by navigating to the signup page and answering the security question prompt.
    📍Steps: Navigate to /register, fill in details, select and answer a security question when prompted.
    Test the new pomace recycling feature by locating the option in the order confirmation or account settings UI after placing an order.
    📍Steps: Place an order, look for the Pomace Recycling checkbox or link in the checkout/confirmation screen to request pickup or delivery.
    • Adds pomace recycling pickup or delivery option during the checkout flow for users to send their pomace box back.
    • Introduces mandatory security question setup during user registration and enables password reset via security question answers.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed support for Node.js 7.x; Docker images node7-* are no longer built.
    • !Snapshot Docker images named *-develop are not built anymore; users must use *-snapshot images instead.
78. v4.1.0 Jun 24, 2017 · release notes

    Adds configurable Retrieve Blueprint challenge and CTF_KEY environment variable

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.1.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v4.1.0

    └──▷ USE IT
    Inject a CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. key without modifying source code for competitive events.
    shell copy

    CTF_KEY=SECRET123 node app.js

    Configure a custom file for the new blueprint challenge in the product inventory.
    yaml copy

    fileForRetrieveBlueprintChallenge: '/static/assets/public/images/blueprint.png'

    • Adds fileForRetrieveBlueprintChallenge property to product configuration for the new Retrieve Blueprint challenge
    • Adds support for injecting CTF flag via the CTF_KEY environment variable
    • Enables marking products as soft-deleted using the deletedDate property in YYYY-MM-DD format

    3 details in Everything

79. v3.1.0 May 11, 2017 · release notes

    Adds per-challenge hints with configurable scoreboard display via showChallengeHints

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v3.1.0

    • Adds hints and hint URLs for each challenge to provide targeted assistance
    • Makes hint visibility on the scoreboard configurable via showChallengeHints (default: true)
    • Implements immediate auto-refresh of the scoreboard upon challenge completion

    3 details in Everything

80. v3.0.0 Apr 28, 2017 · release notes

    v3.0.0 introduces extended configuration mechanism and showGitHubRibbon property.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v3.0.0

    • Adds showGitHubRibbon config property (defaults to true) to control visibility of the GitHub ribbon.
    • Extended configuration mechanism now allows application.logo, application.favicon, and products.image properties to accept both files and URLs.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Custom YAML configuration files from v2.x might not work with v3.0.0; obsolete properties for logo, favicon, and product image URLs have been removed.
81. v2.26.0 Apr 20, 2017 · release notes

    v2.26.0 adds UI toggles for CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. flag notifications and product thumbnails in search results

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.26.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v2.26.0

    └──▷ HOW TO FIND IT
    Quickly copy CTF flag codes during a capture-the-flag event without manual selection.
    📍Look for the copyToClipboard button in the notification UI after solving a challenge.
    Retrieve a CTF flag code you missed by dismissing the initial notification.
    📍Click the re-trigger option on the dismissed notification banner to show the code again.
    Visually identify products when browsing search results in the cyber tooling interface.
    📍Perform a product search and view the thumbnail images displayed for each result item.
    • Adds copyToClipboard button for CTF flag codes in notifications.
    • Enables re-triggering dismissed CTF flag notifications.
    • Shows a thumbnail image of each product in search results.

    3 details in Everything

82. v2.25.0 Apr 1, 2017 · release notes

    v2.25.0 adds corporate domain customization for OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Juice Shop challenges.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.25.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v2.25.0

    └──▷ HOW TO FIND IT
    Tailor the OWASP Juice Shop interface to match internal corporate branding for security awareness training.
    📍Refer to CUSTOMIZATION.md in the repository root to configure inventory content and visual styles.
    • Adds support for customizing inventory content and look & feel to tailor the application to a specific corporate business domain.

    1 detail in Everything

83. v2.22.0 Feb 10, 2017 · release notes

    Juice Shop v2.22.0 adds challenge names to the Score Board table and notifications

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.22.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v2.22.0

    • Adds challenge names as a column in the Score Board table for easier identification of solved challenges.
    • Adds challenge names within notification messages so users can see which challenge was solved at a glance.

    2 details in Everything

84. v2.21.1 Jan 27, 2017 · release notes

    Adds category field to challenges and CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. flag-code for solved challenges

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.21.1 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v2.21.1

    • Challenges now have a category field (e.g. for Jeopardy-like CTFs)
    • Solved challenges now show a flag-code for CTFs

    2 details in Everything

85. v2.20.0 Dec 28, 2016 · release notes

    OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Juice Shop v2.20.0 adds Bitcoin donation paywall and QR code modal dialog

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.20.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v2.20.0

    └──▷ HOW TO FIND IT
    View the QR code for Bitcoin donations in the UI
    📍In your browser, navigate to the Your Basket screen. Locate and interact with the Bitcoin donation option to open the QR code modal dialog.
    • Adds a Premium Challenge locked behind a Bitcoin paywall
    • Adds a QR code modal dialog for Bitcoin donations on the Your Basket screen
    • Adopts the Continue Code challenge to work with the new save/restore feature

    3 details in Everything

86. v2.19.0 Dec 7, 2016 · release notes

    Adds KeePass-based user login challenge

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.19.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v2.19.0

    └──▷ HOW TO FIND IT
    Test authentication flows against the new KeePass-based login challenge in OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Juice Shop v2.19.0.
    📍Open http://localhost:3000 and attempt to log in using your KeePass database file.
    • Introduces a new login challenge that requires users to authenticate using their KeePass password database.

    1 detail in Everything

87. v2.17.0 Nov 3, 2016 · release notes

    Juice Shop v2.17.0 adds Google OAuth login and updates difficulty ratings

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.17.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v2.17.0

    └──▷ HOW TO FIND IT
    Log in to Juice Shop using your Google account via the new OAuth integration.
    📍In the browser, navigate to #/login and click the Log in with Google button.
    • Adds sign-up with Google account using OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms.
    • Changes challenge difficulty ratings from a 1-3 scale to a 1-5 scale

    2 details in Everything

88. v0.3.0 Oct 21, 2014 · release notes

    Juice Shop v0.3.0 launches as a web application security training platform with OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 challenges.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.0 https://github.com/juice-shop/juice-shop.git
    # already have the repo? check out this version:
    $ git checkout v0.3.0

    └──▷ USE IT
    Launch the Juice Shop service instance to begin practicing security challenges against a simulated e-commerce application.
    shell copy

    git clone https://github.com/juice-shop/juice-shop.git && cd juice-shop && git checkout v0.3.0 && npm install && npm start