Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 4, published 25 March 2026.

Which products and versions are affected?

@grackle-ai/server (npm) SEMVER:introduced=0,fixed=0.70.6.

Is there a fix for This vulnerability?

Yes. @grackle-ai/server (npm): upgrade to 0.70.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run @grackle-ai/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Grackle Server JSON.parse missing error handling in gRPC adapter config

Severity: medium · CVSS 4 · Published 2026-03-25

@grackle-ai/server is a Node.js library for managing AI coding agents on remote machines. The service fails to handle errors when parsing JSON-formatted adapter configuration stored in its internal SQLite database, which could cause the gRPC service to crash if the database becomes corrupted or enters an invalid state. Additionally, parsed configuration is cast without validation, creating a potential prototype pollution surface if the database is compromised.

Technologies: @grackle-ai/server (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 4, published 25 March 2026.
Which products and versions are affected?: @grackle-ai/server (npm) SEMVER:introduced=0,fixed=0.70.6.
Is there a fix for This vulnerability?: Yes. @grackle-ai/server (npm): upgrade to 0.70.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run @grackle-ai/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@grackle-ai/server (npm): upgrade to 0.70.6 or later
```
npm install @grackle-ai/server@0.70.6
```

Technical details

The vulnerability is an improper exception handling issue (CWE-754) in the gRPC service layer. JSON.parse() is called on env.adapterConfig in three locations (gRPC-service.ts lines 415, 482, 498) without try-catch wrapping. While the data originates from the server's own SQLite database and should be valid JSON under normal conditions, database corruption, migration errors, or unexpected state transitions can trigger an unhandled exception that crashes the gRPC handler. The parsed result is cast as Record<string, unknown> and passed to adapter methods without property validation, theoretically enabling prototype pollution if the database is compromised. The attack vector requires prior access to modify the SQLite database. Fixed in version 0.70.6; all prior versions are affected.

Affected products

Grackle @grackle-ai/server <= 0.70.5

Timeline

2026-03-22: disclosed
2026-03-25: advisory
2026-03-25: patched: Fixed in version 0.70.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.