Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

engramx

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.6npmAmendedPublished

    engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection

    GHSA-2r2p-4cgf-hv7h

    Affected
    • npm engramx < 2.0.2
    Fixed in
    2.0.2· Vendor fix available
    Issue
    The local HTTP server started by engram server (binding 127.0.0.1:7337 by default) was exposed to any browser origin with no authentication unless ENGRAMAPITOKEN was explicitly set. Combined with Access-Control-Allow-Origin: on every response and a body parser that did not require Content-Type: application/json, this allowed a malicious web page the developer visited to: 1. Exfiltrate the local knowledge graph via GET /query and GET /stats (function names, file layout, recorded decisions/mistakes). 2. Inject persistent prompt-injection payloads via POST /learn, which wrote mistake/decision nodes that were later surfaced as system-reminders to the user's AI coding agent on every future session and file edit. Severity: High — confidentiality + persistent indirect prompt injection against the user's coding agent. Affected versions engramx = 1.0.0, < 2.0.2 — any version that shipped the HTTP server. Patched in engramx@2.0.2 Workarounds (if you cannot upgrade) - Do not run engram…

    Recommended action: Upgrade to 2.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →