Executive brief
Grackle is an HTTP server used to manage and orchestrate AI coding agents on remote machines. The server fails to set critical security headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options) on any HTTP responses, leaving it vulnerable to XSS, clickjacking, and MIME-sniffing attacks. While current XSS exposure is limited due to safe React configuration, any future XSS flaw would lack the secondary defense layer these headers provide.
Technical details
The HTTP server in @grackle-ai/server (packages/server/src/index.ts) fails to include security-related HTTP response headers in any of its writeHead() calls, setting only Content-Type. This is a protection mechanism failure (CWE-693) that reduces defense-in-depth against XSS and clickjacking attacks. The vulnerability requires user interaction (UI:P) via a browser to be exploited. While the current codebase is configured safely for XSS (React-markdown is configured securely, no dangerouslySetInnerHTML usage, source maps disabled), the absence of these headers means any future XSS vulnerability would bypass the secondary defense layer. The fix, available in version 0.70.4, adds Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options headers to all responses. As a workaround, deploying a reverse proxy (nginx, Caddy) in front of Grackle can inject these headers.
Affected products
- nick-pape @grackle-ai/server < 0.70.4
Timeline
- 2026-03-25: disclosed
- 2026-03-25: patched: patch released in version 0.70.4