Read the docs
TI-2026-66426 Aliases GHSA-8g29-8xwr-qmhr

@grackle-ai/server JSON.parse lacks try-catch logic in its gRPC Service AdapterConfig Handling

Priority LOW 38CWE-754Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

### Impact `JSON.parse(env.adapterConfig)` is called without error handling in three locations within the gRPC service. While the data originates from the server's own SQLite database and should always be valid JSON, database corruption, migration errors, or unexpected state could cause an unhandled exception that crashes the gRPC handler. Additionally, the parsed result is cast as `Record<string, unknown>` and passed to adapter methods without property validation, creating a theoretical prototype pollution surface if the database is compromised. **Affected code:** - `packages/server/src/grpc-service.ts:415` — `reconnectOrProvision` handler - `packages/server/src/grpc-service.ts:482` — `stopEnvironment` handler - `packages/server/src/grpc-service.ts:498` — `destroyEnvironment` handler ### Patches **Fix:** Wrap in try-catch and return a meaningful gRPC error: ```typescript let config: Record<string, unknown>; try { config = JSON.parse(env.adapterConfig) as Record<string, unknown>; } catch { throw new ConnectError("Invalid adapter configuration", Code.Internal); } ``` ### Workarounds Ensure database integrity. Back up the SQLite database regularly. ### Resources - CWE-754: Improper Check for Unusual or Exceptional Conditions - File: `packages/server/src/grpc-service.ts`

Why it matters now

Fix Fixed @grackle-ai/server (npm): 0.70.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—@grackle-ai/server (npm)before 0.70.60.70.6Patch availableGHSA-8g29-8xwr-qmhr
  • @grackle-ai/server (npm) Vendor— Affected before 0.70.6 Fixed in 0.70.6 Patch available GHSA-8g29-8xwr-qmhr

Remediation

  • Fix · GHSA-8g29-8xwr-qmhr @grackle-ai/server (npm) Fixed in 0.70.6 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-8g29-8xwr-qmhr

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences