Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact JSON.parse(env.adapterConfig) is called without error handling in three locations within the gRPC service. While the data originates from the server's own SQLite database and should always be valid JSON, database corruption, migration errors, or unexpected state could cause an unhandled exception that crashes the gRPC handler. Additionally, the parsed result is cast as Record<string, unknown and passed to adapter methods without property validation, creating a theoretical prototype pollution surface if the database is compromised. Affected code: - packages/server/src/grpc-service.ts:415 — reconnectOrProvision handler - packages/server/src/grpc-service.ts:482 — stopEnvironment handler - packages/server/src/grpc-service.ts:498 — destroyEnvironment handler Patches Fix: Wrap in try-catch and return a meaningful gRPC error: Workarounds Ensure database integrity. Back up the SQLite database regularly. Resources - CWE-754: Improper Check for Unusual or Exceptional Conditions - File:…
Recommended action: Upgrade to 0.70.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The session cookie is set with HttpOnly; SameSite=Lax; Path=/ but does not include the Secure flag. This means the cookie will be sent over plain HTTP connections. Since the server binds to 127.0.0.1 by default and uses HTTP (not HTTPS), this is acceptable for localhost use. However, when --allow-network is used to bind to 0.0.0.0, cookies could be transmitted over insecure network connections and intercepted by an attacker. Affected code: - packages/server/src/session.ts:76 — cookie string lacks ; Secure attribute Patches 0.70.5 Fix: Conditionally add ; Secure when served over HTTPS or when --allow-network is enabled: Workarounds Do not use --allow-network over untrusted networks without a TLS-terminating reverse proxy. Resources - OWASP: Secure Cookie Attribute - File: packages/server/src/session.ts
Recommended action: Upgrade to 0.70.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The HTTP server does not set Content-Security-Policy, X-Frame-Options, or X-Content-Type-Options headers on any response. This reduces defense-in-depth against XSS, clickjacking, and MIME-sniffing attacks. While the current XSS attack surface is small (React-markdown is configured safely, no dangerouslySetInnerHTML, Vite does not generate source maps), the absence of these headers means any future XSS vulnerability would have no secondary defense layer. Affected code: - packages/server/src/index.ts — all res.writeHead() calls only set Content-Type, with no security headers Patches 0.70.4 Fix: Add security headers to all HTML/API responses: Workarounds Use a reverse proxy (nginx, Caddy) in front of the Grackle server to inject security headers. References - CWE-693: Protection Mechanism Failure - OWASP: HTTP Security Response Headers - File: packages/server/src/index.ts
Recommended action: Upgrade to 0.70.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The WebSocket upgrade handler in the server validates authentication (API key token or session cookie) but does not check the Origin header. A malicious webpage on a different origin could initiate a WebSocket connection to ws://localhost:3000/ws if it can leverage the user's session cookie (which is SameSite=Lax, allowing top-level navigations). This enables cross-origin WebSocket hijacking — if a user visits a malicious site while a Grackle session is active, the attacker's page could open a WebSocket and subscribe to real-time events (session output, task updates, environment state). Affected code: - packages/server/src/ws-bridge.ts:80-91 — connection handler accepts WebSocket upgrades without checking req.headers.origin Patches Fix: Validate req.headers.origin against an allowlist before accepting connections: Workarounds Ensure the Grackle server is only accessible on 127.0.0.1 (the default). Do not use --allow-network in untrusted network environments. Resources -…
Recommended action: Upgrade to 0.70.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The renderPairingPage() function embeds the error parameter directly into HTML without escaping: All current call sites pass hardcoded strings, so this is not exploitable today. However, the function is architecturally fragile — if a future code change passes user-controlled or dynamic content into the error parameter, it would create an XSS vulnerability. The renderAuthorizePage() function in the same file correctly uses escapeHtml() for dynamic content, making this an inconsistency. Affected code: - packages/server/src/index.ts:64-89 — renderPairingPage() with unescaped error interpolation - Compare: packages/server/src/index.ts:130 — renderAuthorizePage() correctly uses escapeHtml() Patches v0.70.1 Fix: Apply escapeHtml() to the error parameter: Workarounds No workaround needed — all current callers pass hardcoded strings. Resources - CWE-79: Improper Neutralization of Input During Web Page Generation - File: packages/server/src/index.ts
Recommended action: Upgrade to 0.70.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.