{"id":"GHSA-w3hv-x4fp-6h6j","aliases":[],"status":"published","title":"@grackle-ai/server has Missing WebSocket Origin Header Validation","description":"### Impact\n\nThe WebSocket upgrade handler in the server validates authentication (API key token or session cookie) but does not check the `Origin` header. A malicious webpage on a different origin could initiate a WebSocket connection to `ws://localhost:3000/ws` if it can leverage the user's session cookie (which is `SameSite=Lax`, allowing top-level navigations).\n\nThis enables **cross-origin WebSocket hijacking** — if a user visits a malicious site while a Grackle session is active, the attacker's page could open a WebSocket and subscribe to real-time events (session output, task updates, environment state).\n\n**Affected code:**\n- `packages/server/src/ws-bridge.ts:80-91` — connection handler accepts WebSocket upgrades without checking `req.headers.origin`\n\n### Patches\n\n**Fix:** Validate `req.headers.origin` against an allowlist before accepting connections:\n```typescript\nconst origin = req.headers.origin || \"\";\nif (origin \u0026\u0026 !origin.includes(\"localhost\") \u0026\u0026 !origin.includes(\"127.0.0.1\")) {\n  ws.close(4003, \"Invalid origin\");\n  return;\n}\n```\n\n### Workarounds\n\nEnsure the Grackle server is only accessible on `127.0.0.1` (the default). Do not use `--allow-network` in untrusted network environments.\n\n### Resources\n\n- CWE-346: Origin Validation Error\n- File: `packages/server/src/ws-bridge.ts`","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-346"],"published":"2026-03-25T17:27:48Z","modified":"2026-03-25T17:32:33Z","fixes":[{"ecosystem":"npm","package":"@grackle-ai/server","fixed_in":["0.70.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@grackle-ai/server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.70.2"},{"fixed":"0.70.3"}]}]},{"source":"osv","ecosystem":"npm","package":"@grackle-ai/server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.70.3"}]}]}],"references":[{"url":"https://github.com/nick-pape/grackle/security/advisories/GHSA-w3hv-x4fp-6h6j","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w3hv-x4fp-6h6j"},{"url":"https://github.com/nick-pape/grackle","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-w3hv-x4fp-6h6j","title":"@grackle-ai/server has Missing WebSocket Origin Header Validation","description":"### Impact\n\nThe WebSocket upgrade handler in the server validates authentication (API key token or session cookie) but does not check the `Origin` header. A malicious webpage on a different origin could initiate a WebSocket connection to `ws://localhost:3000/ws` if it can leverage the user's session cookie (which is `SameSite=Lax`, allowing top-level navigations).\n\nThis enables **cross-origin WebSocket hijacking** — if a user visits a malicious site while a Grackle session is active, the attacker's page could open a WebSocket and subscribe to real-time events (session output, task updates, environment state).\n\n**Affected code:**\n- `packages/server/src/ws-bridge.ts:80-91` — connection handler accepts WebSocket upgrades without checking `req.headers.origin`\n\n### Patches\n\n**Fix:** Validate `req.headers.origin` against an allowlist before accepting connections:\n```typescript\nconst origin = req.headers.origin || \"\";\nif (origin \u0026\u0026 !origin.includes(\"localhost\") \u0026\u0026 !origin.includes(\"127.0.0.1\")) {\n  ws.close(4003, \"Invalid origin\");\n  return;\n}\n```\n\n### Workarounds\n\nEnsure the Grackle server is only accessible on `127.0.0.1` (the default). Do not use `--allow-network` in untrusted network environments.\n\n### Resources\n\n- CWE-346: Origin Validation Error\n- File: `packages/server/src/ws-bridge.ts`","status":"published","published":"2026-03-25T17:27:48Z","modified":"2026-03-25T17:28:07Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:39:41.724707Z"}],"osv":[{"id":"GHSA-w3hv-x4fp-6h6j","title":"@grackle-ai/server has Missing WebSocket Origin Header Validation","description":"### Impact\n\nThe WebSocket upgrade handler in the server validates authentication (API key token or session cookie) but does not check the `Origin` header. A malicious webpage on a different origin could initiate a WebSocket connection to `ws://localhost:3000/ws` if it can leverage the user's session cookie (which is `SameSite=Lax`, allowing top-level navigations).\n\nThis enables **cross-origin WebSocket hijacking** — if a user visits a malicious site while a Grackle session is active, the attacker's page could open a WebSocket and subscribe to real-time events (session output, task updates, environment state).\n\n**Affected code:**\n- `packages/server/src/ws-bridge.ts:80-91` — connection handler accepts WebSocket upgrades without checking `req.headers.origin`\n\n### Patches\n\n**Fix:** Validate `req.headers.origin` against an allowlist before accepting connections:\n```typescript\nconst origin = req.headers.origin || \"\";\nif (origin \u0026\u0026 !origin.includes(\"localhost\") \u0026\u0026 !origin.includes(\"127.0.0.1\")) {\n  ws.close(4003, \"Invalid origin\");\n  return;\n}\n```\n\n### Workarounds\n\nEnsure the Grackle server is only accessible on `127.0.0.1` (the default). Do not use `--allow-network` in untrusted network environments.\n\n### Resources\n\n- CWE-346: Origin Validation Error\n- File: `packages/server/src/ws-bridge.ts`","status":"published","published":"2026-03-25T17:27:48Z","modified":"2026-03-25T17:32:33.983104Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T15:46:58.04805Z"}]}}