{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.70.5"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@grackle-ai/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.70.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-754"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-25T17:33:01Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Impact\n\n`JSON.parse(env.adapterConfig)` is called without error handling in three locations within the gRPC service. While the data originates from the server\u0027s own SQLite database and should always be valid JSON, database corruption, migration errors, or unexpected state could cause an unhandled exception that crashes the gRPC handler.\n\nAdditionally, the parsed result is cast as `Record\u003cstring, unknown\u003e` and passed to adapter methods without property validation, creating a theoretical prototype pollution surface if the database is compromised.\n\n**Affected code:**\n- `packages/server/src/grpc-service.ts:415` \u2014 `reconnectOrProvision` handler\n- `packages/server/src/grpc-service.ts:482` \u2014 `stopEnvironment` handler\n- `packages/server/src/grpc-service.ts:498` \u2014 `destroyEnvironment` handler\n\n### Patches\n\n**Fix:** Wrap in try-catch and return a meaningful gRPC error:\n```typescript\nlet config: Record\u003cstring, unknown\u003e;\ntry {\n  config = JSON.parse(env.adapterConfig) as Record\u003cstring, unknown\u003e;\n} catch {\n  throw new ConnectError(\"Invalid adapter configuration\", Code.Internal);\n}\n```\n\n### Workarounds\n\nEnsure database integrity. Back up the SQLite database regularly.\n\n### Resources\n\n- CWE-754: Improper Check for Unusual or Exceptional Conditions\n- File: `packages/server/src/grpc-service.ts`",
  "id": "GHSA-8g29-8xwr-qmhr",
  "modified": "2026-03-25T17:33:01Z",
  "published": "2026-03-25T17:33:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nick-pape/grackle/security/advisories/GHSA-8g29-8xwr-qmhr"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nick-pape/grackle"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "@grackle-ai/server JSON.parse lacks try-catch logic in its gRPC Service AdapterConfig Handling"
}