{"data":{"id":"dff483d1-82dd-40ad-977a-7031d3be4214","title":"GHSA-2r2p-4cgf-hv7h: engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection","summary":"The local HTTP server started by `engram server` (default `127.0.0.1:7337`) accepted requests from any browser origin with no authentication unless `ENGRAM_API_TOKEN` was set. Combined with `Access-Control-Allow-Origin: *` and a body parser that did not require `Content-Type: application/json`, a malicious web page could read the knowledge graph via `GET /query` and `GET /stats`, and write persistent prompt-injection payloads via `POST /learn`, which were later surfaced to the user's AI coding agent. Affected versions are `engramx` >= 1.0.0 and < 2.0.2.","solution":"Fixed in `engramx@2.0.2`. Remediation in 2.0.2 includes fail-closed auth on non-public routes (Bearer header or HttpOnly cookie, constant-time comparison, 256-bit token at `~/.engram/http-server.token`), removal of wildcard CORS with an opt-in allowlist via `ENGRAM_ALLOWED_ORIGINS`, Host and Origin validation, enforced `Content-Type: application/json` on mutations, and a `/ui?token=` bootstrap with a `Sec-Fetch-Site` gate. Workarounds if upgrading is not possible: do not run `engram server` or `engram ui`, or set `ENGRAM_API_TOKEN` to a long random value and stop the server before browsing the web.","labels":["security","safety"],"sourceUrl":"https://github.com/advisories/GHSA-2r2p-4cgf-hv7h","publishedAt":"2026-04-22T14:52:03.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["prompt_injection","data_extraction"],"issueType":"vulnerability","affectedPackages":["engramx@< 2.0.2 (fixed: 2.0.2)"],"affectedPackageNames":["engramx"],"affectedPackageRefs":["npm:engramx"],"affectedVendors":[],"affectedVendorsRaw":["engram","engramx"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-2r2p-4cgf-hv7h"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-04-22T14:52:03.000Z","fixReleasedAt":"2026-04-18T05:13:22.676Z","daysToFix":-4,"fixCheckedAt":"2026-10-29T21:37:43.946Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"npm","name":"engramx","fixedVersion":"2.0.2","matchedVersion":"2.0.2","fixReleasedAt":"2026-04-18T05:13:22.676Z","daysToFix":-4,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:37:43.798Z"}]}}