GHSA-w3hv-x4fp-6h6j — @grackle-ai/server
GHSA-w3hv-x4fp-6h6j is a security vulnerability in @grackle-ai/server. A fix is available for @grackle-ai/server — see the affected versions and patch details below.
@grackle-ai/server has Missing WebSocket Origin Header Validation
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
@grackle-ai/servernpmDescription
Impact
The WebSocket upgrade handler in the server validates authentication (API key token or session cookie) but does not check the Origin header. A malicious webpage on a different origin could initiate a WebSocket connection to ws://localhost:3000/ws if it can leverage the user's session cookie (which is SameSite=Lax, allowing top-level navigations).
This enables cross-origin WebSocket hijacking — if a user visits a malicious site while a Grackle session is active, the attacker's page could open a WebSocket and subscribe to real-time events (session output, task updates, environment state).
Affected code:
packages/server/src/ws-bridge.ts:80-91— connection handler accepts WebSocket upgrades without checkingreq.headers.origin
Patches
Fix: Validate req.headers.origin against an allowlist before accepting connections:
const origin = req.headers.origin || "";
if (origin && !origin.includes("localhost") && !origin.includes("127.0.0.1")) {
ws.close(4003, "Invalid origin");
return;
}
Workarounds
Ensure the Grackle server is only accessible on 127.0.0.1 (the default). Do not use --allow-network in untrusted network environments.
Resources
- CWE-346: Origin Validation Error
- File:
packages/server/src/ws-bridge.ts
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | @grackle-ai/server | all versions | 0.70.3npm install @grackle-ai/server@0.70.3 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @grackle-ai/server, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update @grackle-ai/server to 0.70.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-w3hv-x4fp-6h6j is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-w3hv-x4fp-6h6j can be triaged on real exposure rather than presence alone.
Tailored to GHSA-w3hv-x4fp-6h6j. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-w3hv-x4fp-6h6j in your dependencies?
O3 Security finds GHSA-w3hv-x4fp-6h6j across npm dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.