argh
added sanity check test for Scanner
turns out, json has two versions and both are vulnerable