PT-2026-30395 · Npm · @Grackle-Ai/Server

Publicado

2026-03-25

·

Atualizado

2026-03-25

CVSS v4.0

2.1

Baixa

VetorAV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Impact

JSON.parse(env.adapterConfig) is called without error handling in three locations within the gRPC service. While the data originates from the server's own SQLite database and should always be valid JSON, database corruption, migration errors, or unexpected state could cause an unhandled exception that crashes the gRPC handler.
Additionally, the parsed result is cast as Record<string, unknown> and passed to adapter methods without property validation, creating a theoretical prototype pollution surface if the database is compromised.
Affected code:
  • packages/server/src/grpc-service.ts:415 — reconnectOrProvision handler
  • packages/server/src/grpc-service.ts:482 — stopEnvironment handler
  • packages/server/src/grpc-service.ts:498 — destroyEnvironment handler

Patches

Fix: Wrap in try-catch and return a meaningful gRPC error:
typescript
let config: Record<string, unknown>;
try {
 config = JSON.parse(env.adapterConfig) as Record<string, unknown>;
} catch {
 throw new ConnectError("Invalid adapter configuration", Code.Internal);
}

Workarounds

Ensure database integrity. Back up the SQLite database regularly.

Resources

  • CWE-754: Improper Check for Unusual or Exceptional Conditions
  • File: packages/server/src/grpc-service.ts

Correção

Improper Check for Exceptional Conditions

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-754

Identificadores relacionados

GHSA-8G29-8XWR-QMHR

Produtos afetados

@Grackle-Ai/Server