GHSA-3mjm-x6gw-2x42
@grackle-ai/server has Missing Content-Security-Policy and X-Frame-Options Headers
GHSA-3mjm-x6gw-2x42 is a medium vulnerability (CVSS 5.3) in @grackle-ai/server, published March 25, 2026. No source lists public exploit code. Fixed in @grackle-ai/server 0.70.4.
- Severity
- 5.3 MediumCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.70.4@grackle-ai/server +1 more
Description
Impact
The HTTP server does not set Content-Security-Policy, X-Frame-Options, or X-Content-Type-Options headers on any response. This reduces defense-in-depth against XSS, clickjacking, and MIME-sniffing attacks.
While the current XSS attack surface is small (React-markdown is configured safely, no dangerouslySetInnerHTML, Vite does not generate source maps), the absence of these headers means any future XSS vulnerability would have no secondary defense layer.
Affected code:
packages/server/src/index.ts— allres.writeHead()calls only setContent-Type, with no security headers
Patches
0.70.4
Fix: Add security headers to all HTML/API responses:
res.writeHead(200, {
"Content-Type": contentType,
"Content-Security-Policy": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:",
"X-Frame-Options": "DENY",
"X-Content-Type-Options": "nosniff"
});
Workarounds
Use a reverse proxy (nginx, Caddy) in front of the Grackle server to inject security headers.
References
- CWE-693: Protection Mechanism Failure
- OWASP: HTTP Security Response Headers
- File:
packages/server/src/index.ts
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@grackle-ai/servernpm | through 0.70.3 | 0.70.4 |
@grackle-ai/servernpm | before 0.70.4 | 0.70.4 |
What each source reports
GitHub Advisories Score used
@grackle-ai/server has Missing Content-Security-Policy and X-Frame-Options Headers
Impact
The HTTP server does not set Content-Security-Policy, X-Frame-Options, or X-Content-Type-Options headers on any response. This reduces defense-in-depth against XSS, clickjacking, and MIME-sniffing attacks.
While the current XSS attack surface is small (React-markdown is configured safely, no dangerouslySetInnerHTML, Vite does not generate source maps), the absence of these headers means any future XSS vulnerability would have no secondary defense layer.
Affected code:
packages/server/src/index.ts— allres.writeHead()calls only setContent-Type, with no security headers
Patches
0.70.4
Fix: Add security headers to all HTML/API responses:
res.writeHead(200, {
"Content-Type": contentType,
"Content-Security-Policy": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:",
"X-Frame-Options": "DENY",
"X-Content-Type-Options": "nosniff"
});
Workarounds
Use a reverse proxy (nginx, Caddy) in front of the Grackle server to inject security headers.
References
- CWE-693: Protection Mechanism Failure
- OWASP: HTTP Security Response Headers
- File:
packages/server/src/index.ts
- Record
GHSA-3mjm-x6gw-2x42- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-79, CWE-693
- Updated
- 2026-11-02
OSV
@grackle-ai/server has Missing Content-Security-Policy and X-Frame-Options Headers
Impact
The HTTP server does not set Content-Security-Policy, X-Frame-Options, or X-Content-Type-Options headers on any response. This reduces defense-in-depth against XSS, clickjacking, and MIME-sniffing attacks.
While the current XSS attack surface is small (React-markdown is configured safely, no dangerouslySetInnerHTML, Vite does not generate source maps), the absence of these headers means any future XSS vulnerability would have no secondary defense layer.
Affected code:
packages/server/src/index.ts— allres.writeHead()calls only setContent-Type, with no security headers
Patches
0.70.4
Fix: Add security headers to all HTML/API responses:
res.writeHead(200, {
"Content-Type": contentType,
"Content-Security-Policy": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:",
"X-Frame-Options": "DENY",
"X-Content-Type-Options": "nosniff"
});
Workarounds
Use a reverse proxy (nginx, Caddy) in front of the Grackle server to inject security headers.
References
- CWE-693: Protection Mechanism Failure
- OWASP: HTTP Security Response Headers
- File:
packages/server/src/index.ts
- Record
GHSA-3mjm-x6gw-2x42- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-693, CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.