LowVulnerability
GHSA-7q9x-8g6p-3x75: @grackle-ai/server: Unescaped Error String in renderPairingPage() HTML Template
- Identifier
- GHSA-7q9x-8g6p-3x75
- Published
- Record updated
- Affected
- @grackle-ai/server <= 0.70.0
- Fixed in
- 0.70.1
- released March 22, 2026, 3 days before disclosure
Summary
GHSA-7q9x-8g6p-3x75 affects @grackle-ai/server. Its renderPairingPage() function interpolates the error parameter into HTML without escaping, unlike renderAuthorizePage() in the same file, which uses escapeHtml(). All current call sites pass hardcoded strings, so the flaw is not exploitable today, but a future change passing user-controlled content into that parameter would create an XSS vulnerability (CWE-79).
Mitigation
Fixed in v0.70.1. Apply escapeHtml() to the error parameter: const errorHtml = error ? `<p style="color:#e74c3c">${escapeHtml(error)}</p>` : "";
Related items
- MediumRecent AI agent experiments reveal a risky future of machine 'teamwork' inside corporationsSimilar attack · CNBC Technology
- MediumClaude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubSimilar attack · The Hacker News
- MediumCVE-2026-118046: JS Help Desk plugin stored DOM-based cross-site scripting via jsticket_messageSimilar attack · NVD/CVE Database
- MediumARTEX abuse expands as cybercriminals target financial sectorSimilar attack · Microsoft Security Blog
- MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database