Executive brief
Grackle AI's runtime SDK and PowerLine orchestration tools are vulnerable to a flaw that allows an attacker to execute unauthorized commands on managed servers, Docker containers, or cloud environments. By providing a specially crafted branch name during a session request, an attacker can bypass security sandboxes and gain full control over the provisioned environment. This could lead to the theft of sensitive data, service disruption, or the use of corporate infrastructure for malicious activities.
Technical details
The vulnerability consists of two defects (CWE-78 and CWE-88) in the `worktree.ts` component of the Grackle AI runtime SDK. The primary issue (F1) occurs because `NODE_GIT_EXECUTOR.exec` spawns git commands using `shell: true` in Node.js, which causes arguments to be concatenated into a single string and executed via `sh -c` without proper escaping. An untrusted `branch` name from a gRPC `SpawnSession` request flows directly into this sink. A secondary issue (F13) involves missing `--` delimiters, allowing for argument injection. An attacker with access to the orchestration layer or the ability to spawn tasks can achieve arbitrary command execution as the PowerLine user on any provisioned host. Remediation involves removing the shell execution requirement and implementing strict input validation at the gRPC boundary.
Affected products
- Grackle AI @grackle-ai/runtime-sdk <= 0.132.1
- Grackle AI @grackle-ai/powerline <= 0.132.1
Timeline
- 2026-05-29: disclosed: Initial publication by researcher
- 2026-07-02: advisory: GitHub Advisory published