Skip to content
AI Sec Watch
HighVulnerabilityLLM-specific

GHSA-2r2p-4cgf-hv7h: engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection

Source
GitHub Advisory(opens in a new tab)
Identifier
GHSA-2r2p-4cgf-hv7h
Published
Record updated
View JSON
Affected
  • engramx < 2.0.2
Fixed in
2.0.2
  • released April 18, 2026, 4 days before disclosure

Summary

The local HTTP server started by `engram server` (default `127.0.0.1:7337`) accepted requests from any browser origin with no authentication unless `ENGRAM_API_TOKEN` was set. Combined with `Access-Control-Allow-Origin: *` and a body parser that did not require `Content-Type: application/json`, a malicious web page could read the knowledge graph via `GET /query` and `GET /stats`, and write persistent prompt-injection payloads via `POST /learn`, which were later surfaced to the user's AI coding agent. Affected versions are `engramx` >= 1.0.0 and < 2.0.2.

Mitigation

Fixed in `engramx@2.0.2`. Remediation in 2.0.2 includes fail-closed auth on non-public routes (Bearer header or HttpOnly cookie, constant-time comparison, 256-bit token at `~/.engram/http-server.token`), removal of wildcard CORS with an opt-in allowlist via `ENGRAM_ALLOWED_ORIGINS`, Host and Origin validation, enforced `Content-Type: application/json` on mutations, and a `/ui?token=` bootstrap with a `Sec-Fetch-Site` gate. Workarounds if upgrading is not possible: do not run `engram server` or `engram ui`, or set `ENGRAM_API_TOKEN` to a long random value and stop the server before browsing the web.

Topics

Related items