GHSA-7q9x-8g6p-3x75
@grackle-ai/server: Unescaped Error String in renderPairingPage() HTML Template
GHSA-7q9x-8g6p-3x75 is a low vulnerability (CVSS 2.3) in @grackle-ai/server, published March 25, 2026. No source lists public exploit code. Fixed in @grackle-ai/server 0.70.1.
- Severity
- 2.3 LowCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.70.1@grackle-ai/server +1 more
Description
Impact
The renderPairingPage() function embeds the error parameter directly into HTML without escaping:
const errorHtml = error ? `<p style="color:#e74c3c">${error}</p>` : "";
All current call sites pass hardcoded strings, so this is not exploitable today. However, the function is architecturally fragile — if a future code change passes user-controlled or dynamic content into the error parameter, it would create an XSS vulnerability.
The renderAuthorizePage() function in the same file correctly uses escapeHtml() for dynamic content, making this an inconsistency.
Affected code:
packages/server/src/index.ts:64-89—renderPairingPage()with unescaped error interpolation- Compare:
packages/server/src/index.ts:130—renderAuthorizePage()correctly usesescapeHtml()
Patches
v0.70.1
Fix: Apply escapeHtml() to the error parameter:
const errorHtml = error ? `<p style="color:#e74c3c">${escapeHtml(error)}</p>` : "";
Workarounds
No workaround needed — all current callers pass hardcoded strings.
Resources
- CWE-79: Improper Neutralization of Input During Web Page Generation
- File:
packages/server/src/index.ts
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@grackle-ai/servernpm | through 0.70.0 | 0.70.1 |
@grackle-ai/servernpm | before 0.70.1 | 0.70.1 |
What each source reports
GitHub Advisories Score used
@grackle-ai/server: Unescaped Error String in renderPairingPage() HTML Template
Impact
The renderPairingPage() function embeds the error parameter directly into HTML without escaping:
const errorHtml = error ? `<p style="color:#e74c3c">${error}</p>` : "";
All current call sites pass hardcoded strings, so this is not exploitable today. However, the function is architecturally fragile — if a future code change passes user-controlled or dynamic content into the error parameter, it would create an XSS vulnerability.
The renderAuthorizePage() function in the same file correctly uses escapeHtml() for dynamic content, making this an inconsistency.
Affected code:
packages/server/src/index.ts:64-89—renderPairingPage()with unescaped error interpolation- Compare:
packages/server/src/index.ts:130—renderAuthorizePage()correctly usesescapeHtml()
Patches
v0.70.1
Fix: Apply escapeHtml() to the error parameter:
const errorHtml = error ? `<p style="color:#e74c3c">${escapeHtml(error)}</p>` : "";
Workarounds
No workaround needed — all current callers pass hardcoded strings.
Resources
- CWE-79: Improper Neutralization of Input During Web Page Generation
- File:
packages/server/src/index.ts
- Record
GHSA-7q9x-8g6p-3x75- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
@grackle-ai/server: Unescaped Error String in renderPairingPage() HTML Template
Impact
The renderPairingPage() function embeds the error parameter directly into HTML without escaping:
const errorHtml = error ? `<p style="color:#e74c3c">${error}</p>` : "";
All current call sites pass hardcoded strings, so this is not exploitable today. However, the function is architecturally fragile — if a future code change passes user-controlled or dynamic content into the error parameter, it would create an XSS vulnerability.
The renderAuthorizePage() function in the same file correctly uses escapeHtml() for dynamic content, making this an inconsistency.
Affected code:
packages/server/src/index.ts:64-89—renderPairingPage()with unescaped error interpolation- Compare:
packages/server/src/index.ts:130—renderAuthorizePage()correctly usesescapeHtml()
Patches
v0.70.1
Fix: Apply escapeHtml() to the error parameter:
const errorHtml = error ? `<p style="color:#e74c3c">${escapeHtml(error)}</p>` : "";
Workarounds
No workaround needed — all current callers pass hardcoded strings.
Resources
- CWE-79: Improper Neutralization of Input During Web Page Generation
- File:
packages/server/src/index.ts
- Record
GHSA-7q9x-8g6p-3x75- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.