Skip to content
OpenAdvisories

Package · npm

@grackle-ai/runtime-sdk

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High —
    GHSA-vv65-f55v-xm6g

    Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true)

    ## Summary The default git executor used for all worktree operations spawns `git` through a shell, and the untrusted task **branch** name flows into the command unsanitized. A caller able to reach the PowerLine `SpawnSession` RPC (a malicious or compromised a…

    @grackle-ai/powerline @grackle-ai/runtime-sdk npm