Skip to content
OpenAdvisories

Package · npm

@grackle-ai/server

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low —
    GHSA-8g29-8xwr-qmhr

    @grackle-ai/server JSON.parse lacks try-catch logic in its gRPC Service AdapterConfig Handling

    ### Impact `JSON.parse(env.adapterConfig)` is called without error handling in three locations within the gRPC service. While the data originates from the server's own SQLite database and should always be valid JSON, database corruption, migration errors, or …

    @grackle-ai/server npm
  • Low —
    GHSA-5j35-xr4g-vwf4

    @grackle-ai/server has a Missing Secure Flag on Session Cookie

    ### Impact The session cookie is set with `HttpOnly; SameSite=Lax; Path=/` but does not include the `Secure` flag. This means the cookie will be sent over plain HTTP connections. Since the server binds to `127.0.0.1` by default and uses HTTP (not HTTPS), this…

    @grackle-ai/server npm
  • Low —
    GHSA-7q9x-8g6p-3x75

    @grackle-ai/server: Unescaped Error String in renderPairingPage() HTML Template

    ### Impact The `renderPairingPage()` function embeds the `error` parameter directly into HTML without escaping: ```typescript const errorHtml = error ? `<p style="color:#e74c3c">${error}</p>` : ""; ``` All current call sites pass hardcoded strings, so this is…

    @grackle-ai/server npm