@grackle-ai/powerline 0.47.0

Direct Vulnerabilities

Known vulnerabilities in the @grackle-ai/powerline package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Arbitrary Argument Injection @grackle-ai/powerline is a gRPC PowerLine server for Grackle AI agent integration Affected versions of this package are vulnerable to Arbitrary Argument Injection via unsanitized input to the `branch` parameter in the `SpawnSession` process. An attacker can execute arbitrary commands as the application user on provisioned environments by supplying crafted branch names that are concatenated into a shell command without proper validation. How to fix Arbitrary Argument Injection? Upgrade `@grackle-ai/powerline` to version 0.133.0 or higher.	<0.133.0
M Missing Authentication for Critical Function @grackle-ai/powerline is a gRPC PowerLine server for Grackle AI agent integration Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the PowerLine gRPC server when when `--token` is not provided and `GRACKLE_POWERLINE_TOKEN` is not set. An attacker can gain unauthorized access, spawn agent sessions, retrieve credential tokens, and execute arbitrary code by connecting to the exposed service. This is only exploitable if the service is bound to a non-localhost interface or is otherwise accessible from outside the local machine. How to fix Missing Authentication for Critical Function? Upgrade `@grackle-ai/powerline` to version 0.70.1 or higher.	<0.70.1

Vulnerability

Vulnerable Version

Arbitrary Argument Injection

@grackle-ai/powerline is a gRPC PowerLine server for Grackle AI agent integration

Affected versions of this package are vulnerable to Arbitrary Argument Injection via unsanitized input to the branch parameter in the SpawnSession process. An attacker can execute arbitrary commands as the application user on provisioned environments by supplying crafted branch names that are concatenated into a shell command without proper validation.

How to fix Arbitrary Argument Injection?

Upgrade @grackle-ai/powerline to version 0.133.0 or higher.

<0.133.0

Missing Authentication for Critical Function

@grackle-ai/powerline is a gRPC PowerLine server for Grackle AI agent integration

Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the PowerLine gRPC server when when --token is not provided and GRACKLE_POWERLINE_TOKEN is not set. An attacker can gain unauthorized access, spawn agent sessions, retrieve credential tokens, and execute arbitrary code by connecting to the exposed service. This is only exploitable if the service is bound to a non-localhost interface or is otherwise accessible from outside the local machine.

How to fix Missing Authentication for Critical Function?

Upgrade @grackle-ai/powerline to version 0.70.1 or higher.

<0.70.1

@grackle-ai/powerline@0.47.0

gRPC PowerLine server for Grackle AI agent integration

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically