Skip to content
Threat Feed
Subscribe

Tag

Code-Vulnerability

2 briefs RSS
high advisory

Grackle AI MCP Tool Layer Fail-Open Authorization Leads to IDOR and Privilege Escalation (GHSA-f9ff-5x35-7gfw)

The Grackle AI MCP tool layer, specifically versions of `@grackle-ai/mcp`, `@grackle-ai/plugin-core`, and `@grackle-ai/auth` up to `0.132.1`, suffers from an authorization bypass (IDOR) due to inconsistent inline checks, allowing a compromised scoped agent to perform unauthorized cross-task and cross-session operations, leading to data manipulation, denial of service, and sensitive data disclosure across workspaces.

@grackle-ai/mcp +2 idor authorization-bypass privilege-escalation denial-of-service code-vulnerability software-component
3t
high advisory

gitoxide Arbitrary Command Execution via .gitmodules Bypass

A vulnerability in gitoxide's `gix_submodule::File::update()` allows arbitrary command execution via a crafted `.gitmodules` file by incorrectly validating the source of the `update` command, enabling an attacker to inject malicious commands after a submodule has been initialized.

gix code-vulnerability remote-code-execution gitoxide
2r 1t 1c