The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
GHSA-5j35-xr4g-vwf4: @grackle-ai/server has a Missing Secure Flag on Session Cookie
- Identifier
- GHSA-5j35-xr4g-vwf4
- Published
- Record updated
- Affected
- @grackle-ai/server <= 0.70.4
- Fixed in
- 0.70.5
Summary
The @grackle-ai/server session cookie is set with HttpOnly, SameSite=Lax and Path=/ but omits the Secure flag, so it can be sent over plain HTTP. The server binds to 127.0.0.1 by default, which the advisory calls acceptable for localhost use, but binding to 0.0.0.0 with --allow-network could let an attacker intercept cookies on an insecure network. The flaw is in packages/server/src/session.ts at line 76.
Mitigation
Fixed in 0.70.5. The fix conditionally adds "; Secure" to the cookie when served over HTTPS or when --allow-network is enabled. Workaround: do not use --allow-network over untrusted networks without a TLS-terminating reverse proxy.