GHSA-2r2p-4cgf-hv7h

Suggest an improvement
Source
https://github.com/advisories/GHSA-2r2p-4cgf-hv7h
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-2r2p-4cgf-hv7h/GHSA-2r2p-4cgf-hv7h.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-2r2p-4cgf-hv7h
Published
2026-04-22T14:52:03Z
Modified
2026-04-22T16:33:00Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection
Details

Summary

The local HTTP server started by engram server (binding 127.0.0.1:7337 by default) was exposed to any browser origin with no authentication unless ENGRAM_API_TOKEN was explicitly set. Combined with Access-Control-Allow-Origin: * on every response and a body parser that did not require Content-Type: application/json, this allowed a malicious web page the developer visited to:

  1. Exfiltrate the local knowledge graph via GET /query and GET /stats (function names, file layout, recorded decisions/mistakes).
  2. Inject persistent prompt-injection payloads via POST /learn, which wrote mistake/decision nodes that were later surfaced as system-reminders to the user's AI coding agent on every future session and file edit.

Severity: High — confidentiality + persistent indirect prompt injection against the user's coding agent.

Affected versions

engramx >= 1.0.0, < 2.0.2 — any version that shipped the HTTP server.

Patched in

engramx@2.0.2

Workarounds (if you cannot upgrade)

  • Do not run engram server or engram ui.
  • If developers must, set ENGRAM_API_TOKEN to a long random value and terminate the server before browsing the web.

Remediation (applied in 2.0.2)

  1. Fail-closed auth on every non-public route — Bearer header or HttpOnly cookie, constant-time comparison, 256-bit auto-generated token at ~/.engram/http-server.token (0600).
  2. Wildcard CORS removed entirely; default is no CORS headers. Opt-in allowlist via ENGRAM_ALLOWED_ORIGINS.
  3. Host + Origin validation — rejects DNS rebinding and Host spoofing.
  4. Content-Type: application/json enforced on mutations — blocks the text/plain CSRF vector.
  5. /ui?token= bootstrap with Sec-Fetch-Site gate — prevents cross-origin oracle probing.

Credit

Discovered and responsibly disclosed by @gabiudrescu in engram issue #7.

Database specific 
{
    "cwe_ids":  [
        "CWE-1188",
        "CWE-306",
        "CWE-352",
        "CWE-942"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-22T14:52:03Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

npm / engramx

Package

Name
engramx
View open source insights on deps.dev
Purl
pkg:npm/engramx

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-2r2p-4cgf-hv7h/GHSA-2r2p-4cgf-hv7h.json"