GHSA-5j35-xr4g-vwf4
@grackle-ai/server has a Missing Secure Flag on Session Cookie
GHSA-5j35-xr4g-vwf4 is a low vulnerability (CVSS 2.3) in @grackle-ai/server, published March 25, 2026. No source lists public exploit code. Fixed in @grackle-ai/server 0.70.5.
- Severity
- 2.3 LowCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.70.5@grackle-ai/server +1 more
Description
Impact
The session cookie is set with HttpOnly; SameSite=Lax; Path=/ but does not include the Secure flag. This means the cookie will be sent over plain HTTP connections.
Since the server binds to 127.0.0.1 by default and uses HTTP (not HTTPS), this is acceptable for localhost use. However, when --allow-network is used to bind to 0.0.0.0, cookies could be transmitted over insecure network connections and intercepted by an attacker.
Affected code:
packages/server/src/session.ts:76— cookie string lacks; Secureattribute
Patches
0.70.5
Fix: Conditionally add ; Secure when served over HTTPS or when --allow-network is enabled:
const securePart = isHttps ? "; Secure" : "";
return `${SESSION_COOKIE_NAME}=${cookieValue}; HttpOnly; SameSite=Lax; Path=/${securePart}; Max-Age=${maxAge}`;
Workarounds
Do not use --allow-network over untrusted networks without a TLS-terminating reverse proxy.
Resources
- OWASP: Secure Cookie Attribute
- File:
packages/server/src/session.ts
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@grackle-ai/servernpm | through 0.70.4 | 0.70.5 |
@grackle-ai/servernpm | before 0.70.5 | 0.70.5 |
What each source reports
GitHub Advisories Score used
@grackle-ai/server has a Missing Secure Flag on Session Cookie
Impact
The session cookie is set with HttpOnly; SameSite=Lax; Path=/ but does not include the Secure flag. This means the cookie will be sent over plain HTTP connections.
Since the server binds to 127.0.0.1 by default and uses HTTP (not HTTPS), this is acceptable for localhost use. However, when --allow-network is used to bind to 0.0.0.0, cookies could be transmitted over insecure network connections and intercepted by an attacker.
Affected code:
packages/server/src/session.ts:76— cookie string lacks; Secureattribute
Patches
0.70.5
Fix: Conditionally add ; Secure when served over HTTPS or when --allow-network is enabled:
const securePart = isHttps ? "; Secure" : "";
return `${SESSION_COOKIE_NAME}=${cookieValue}; HttpOnly; SameSite=Lax; Path=/${securePart}; Max-Age=${maxAge}`;
Workarounds
Do not use --allow-network over untrusted networks without a TLS-terminating reverse proxy.
Resources
- OWASP: Secure Cookie Attribute
- File:
packages/server/src/session.ts
- Record
GHSA-5j35-xr4g-vwf4- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-614
- Updated
- 2026-11-02
OSV
@grackle-ai/server has a Missing Secure Flag on Session Cookie
Impact
The session cookie is set with HttpOnly; SameSite=Lax; Path=/ but does not include the Secure flag. This means the cookie will be sent over plain HTTP connections.
Since the server binds to 127.0.0.1 by default and uses HTTP (not HTTPS), this is acceptable for localhost use. However, when --allow-network is used to bind to 0.0.0.0, cookies could be transmitted over insecure network connections and intercepted by an attacker.
Affected code:
packages/server/src/session.ts:76— cookie string lacks; Secureattribute
Patches
0.70.5
Fix: Conditionally add ; Secure when served over HTTPS or when --allow-network is enabled:
const securePart = isHttps ? "; Secure" : "";
return `${SESSION_COOKIE_NAME}=${cookieValue}; HttpOnly; SameSite=Lax; Path=/${securePart}; Max-Age=${maxAge}`;
Workarounds
Do not use --allow-network over untrusted networks without a TLS-terminating reverse proxy.
Resources
- OWASP: Secure Cookie Attribute
- File:
packages/server/src/session.ts
- Record
GHSA-5j35-xr4g-vwf4- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-614
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.