Skip to content
Fencer Intel
low —

GHSA-8g29-8xwr-qmhr json

@grackle-ai/server JSON.parse lacks try-catch logic in its gRPC Service AdapterConfig Handling

published 7mo ago modified 7mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact

`JSON.parse(env.adapterConfig)` is called without error handling in three locations within the gRPC service. While the data originates from the server's own SQLite database and should always be valid JSON, database corruption, migration errors, or unexpected state could cause an unhandled exception that crashes the gRPC handler.

Additionally, the parsed result is cast as `Record<string, unknown>` and passed to adapter methods without property validation, creating a theoretical prototype pollution surface if the database is compromised.

**Affected code:** - `packages/server/src/grpc-service.ts:415` — `reconnectOrProvision` handler - `packages/server/src/grpc-service.ts:482` — `stopEnvironment` handler - `packages/server/src/grpc-service.ts:498` — `destroyEnvironment` handler

### Patches

**Fix:** Wrap in try-catch and return a meaningful gRPC error: ```typescript let config: Record<string, unknown>; try { config = JSON.parse(env.adapterConfig) as Record<string, unknown>; } catch { throw new ConnectError("Invalid adapter configuration", Code.Internal); } ```

### Workarounds

Ensure database integrity. Back up the SQLite database regularly.

### Resources

- CWE-754: Improper Check for Unusual or Exceptional Conditions - File: `packages/server/src/grpc-service.ts`

Patch / fix

  • npm @grackle-ai/server 0.70.6

Is GHSA-8g29-8xwr-qmhr in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
npm @grackle-ai/server
<0.70.6
0.70.6

Classification

Weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.