Every CVESearch/Get API key

GHSA-8g29-8xwr-qmhr

@grackle-ai/server JSON.parse lacks try-catch logic in its gRPC Service AdapterConfig Handling

2.1 LowFix available

GHSA-8g29-8xwr-qmhr is a low vulnerability (CVSS 2.1) in @grackle-ai/server, published March 25, 2026. No source lists public exploit code. Fixed in @grackle-ai/server 0.70.6.

What does this mean?
Severity
2.1 LowCVSS 4.0, GitHub Advisories
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0.70.6@grackle-ai/server +1 more

Description

Impact

JSON.parse(env.adapterConfig) is called without error handling in three locations within the gRPC service. While the data originates from the server's own SQLite database and should always be valid JSON, database corruption, migration errors, or unexpected state could cause an unhandled exception that crashes the gRPC handler.

Additionally, the parsed result is cast as Record<string, unknown> and passed to adapter methods without property validation, creating a theoretical prototype pollution surface if the database is compromised.

Affected code:

  • packages/server/src/grpc-service.ts:415 — reconnectOrProvision handler
  • packages/server/src/grpc-service.ts:482 — stopEnvironment handler
  • packages/server/src/grpc-service.ts:498 — destroyEnvironment handler

Patches

Fix: Wrap in try-catch and return a meaningful gRPC error:

let config: Record<string, unknown>;
try {
  config = JSON.parse(env.adapterConfig) as Record<string, unknown>;
} catch {
  throw new ConnectError("Invalid adapter configuration", Code.Internal);
}

Workarounds

Ensure database integrity. Back up the SQLite database regularly.

Resources

  • CWE-754: Improper Check for Unusual or Exceptional Conditions
  • File: packages/server/src/grpc-service.ts

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Affected packages

Affected packages
PackageAffectedFixed
@grackle-ai/server
npm
through 0.70.5
0.70.6
@grackle-ai/server
npm
before 0.70.6
0.70.6

What each source reports

GitHub Advisories Score used2.1

@grackle-ai/server JSON.parse lacks try-catch logic in its gRPC Service AdapterConfig Handling

Impact

JSON.parse(env.adapterConfig) is called without error handling in three locations within the gRPC service. While the data originates from the server's own SQLite database and should always be valid JSON, database corruption, migration errors, or unexpected state could cause an unhandled exception that crashes the gRPC handler.

Additionally, the parsed result is cast as Record<string, unknown> and passed to adapter methods without property validation, creating a theoretical prototype pollution surface if the database is compromised.

Affected code:

  • packages/server/src/grpc-service.ts:415 — reconnectOrProvision handler
  • packages/server/src/grpc-service.ts:482 — stopEnvironment handler
  • packages/server/src/grpc-service.ts:498 — destroyEnvironment handler

Patches

Fix: Wrap in try-catch and return a meaningful gRPC error:

let config: Record<string, unknown>;
try {
  config = JSON.parse(env.adapterConfig) as Record<string, unknown>;
} catch {
  throw new ConnectError("Invalid adapter configuration", Code.Internal);
}

Workarounds

Ensure database integrity. Back up the SQLite database regularly.

Resources

  • CWE-754: Improper Check for Unusual or Exceptional Conditions
  • File: packages/server/src/grpc-service.ts
Record
GHSA-8g29-8xwr-qmhr
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-754
Updated
2026-11-02
OSV2.1

@grackle-ai/server JSON.parse lacks try-catch logic in its gRPC Service AdapterConfig Handling

Impact

JSON.parse(env.adapterConfig) is called without error handling in three locations within the gRPC service. While the data originates from the server's own SQLite database and should always be valid JSON, database corruption, migration errors, or unexpected state could cause an unhandled exception that crashes the gRPC handler.

Additionally, the parsed result is cast as Record<string, unknown> and passed to adapter methods without property validation, creating a theoretical prototype pollution surface if the database is compromised.

Affected code:

  • packages/server/src/grpc-service.ts:415 — reconnectOrProvision handler
  • packages/server/src/grpc-service.ts:482 — stopEnvironment handler
  • packages/server/src/grpc-service.ts:498 — destroyEnvironment handler

Patches

Fix: Wrap in try-catch and return a meaningful gRPC error:

let config: Record<string, unknown>;
try {
  config = JSON.parse(env.adapterConfig) as Record<string, unknown>;
} catch {
  throw new ConnectError("Invalid adapter configuration", Code.Internal);
}

Workarounds

Ensure database integrity. Back up the SQLite database regularly.

Resources

  • CWE-754: Improper Check for Unusual or Exceptional Conditions
  • File: packages/server/src/grpc-service.ts
Record
GHSA-8g29-8xwr-qmhr
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-754
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open