GHSA-8g29-8xwr-qmhr

Source

https://github.com/advisories/GHSA-8g29-8xwr-qmhr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8g29-8xwr-qmhr/GHSA-8g29-8xwr-qmhr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8g29-8xwr-qmhr

Published

2026-03-25T17:33:01Z

Modified

2026-03-25T17:46:27.151474Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

@grackle-ai/server JSON.parse lacks try-catch logic in its gRPC Service AdapterConfig Handling

Details

Impact

JSON.parse(env.adapterConfig) is called without error handling in three locations within the gRPC service. While the data originates from the server's own SQLite database and should always be valid JSON, database corruption, migration errors, or unexpected state could cause an unhandled exception that crashes the gRPC handler.

Additionally, the parsed result is cast as Record<string, unknown> and passed to adapter methods without property validation, creating a theoretical prototype pollution surface if the database is compromised.

Affected code: - packages/server/src/grpc-service.ts:415 — reconnectOrProvision handler - packages/server/src/grpc-service.ts:482 — stopEnvironment handler - packages/server/src/grpc-service.ts:498 — destroyEnvironment handler

Patches

Fix: Wrap in try-catch and return a meaningful gRPC error:

let config: Record<string, unknown>;
try {
  config = JSON.parse(env.adapterConfig) as Record<string, unknown>;
} catch {
  throw new ConnectError("Invalid adapter configuration", Code.Internal);
}

Workarounds

Ensure database integrity. Back up the SQLite database regularly.

Resources

CWE-754: Improper Check for Unusual or Exceptional Conditions
File: packages/server/src/grpc-service.ts

Database specific

{
    "severity": "LOW",
    "cwe_ids": [
        "CWE-754"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-25T17:33:01Z",
    "nvd_published_at": null
}

References

Affected packages

npm / @grackle-ai/server

Package

Name: @grackle-ai/server; View open source insights on deps.dev
Purl: pkg:npm/%40grackle-ai/server

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.70.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8g29-8xwr-qmhr/GHSA-8g29-8xwr-qmhr.json"

last_known_affected_version_range

"<= 0.70.5"