GHSA-w3hv-x4fp-6h6j

Source

https://github.com/advisories/GHSA-w3hv-x4fp-6h6j

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-w3hv-x4fp-6h6j/GHSA-w3hv-x4fp-6h6j.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-w3hv-x4fp-6h6j

Published

2026-03-25T17:27:48Z

Modified

2026-03-25T17:32:33Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

@grackle-ai/server has Missing WebSocket Origin Header Validation

Details

Impact

The WebSocket upgrade handler in the server validates authentication (API key token or session cookie) but does not check the Origin header. A malicious webpage on a different origin could initiate a WebSocket connection to ws://localhost:3000/ws if it can leverage the user's session cookie (which is SameSite=Lax, allowing top-level navigations).

This enables cross-origin WebSocket hijacking — if a user visits a malicious site while a Grackle session is active, the attacker's page could open a WebSocket and subscribe to real-time events (session output, task updates, environment state).

Affected code:

packages/server/src/ws-bridge.ts:80-91 — connection handler accepts WebSocket upgrades without checking req.headers.origin

Patches

Fix: Validate req.headers.origin against an allowlist before accepting connections:

const origin = req.headers.origin || "";
if (origin && !origin.includes("localhost") && !origin.includes("127.0.0.1")) {
  ws.close(4003, "Invalid origin");
  return;
}

Workarounds

Ensure the Grackle server is only accessible on 127.0.0.1 (the default). Do not use --allow-network in untrusted network environments.

Resources

CWE-346: Origin Validation Error
File: packages/server/src/ws-bridge.ts

Database specific

{
    "cwe_ids":  [
        "CWE-346"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-25T17:27:48Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / @grackle-ai/server

Package

Name: @grackle-ai/server; View open source insights on deps.dev
Purl: pkg:npm/%40grackle-ai/server

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.70.3

Database specific

last_known_affected_version_range

"<= 0.70.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-w3hv-x4fp-6h6j/GHSA-w3hv-x4fp-6h6j.json"