🛡️ GHSA-7q9x-8g6p-3x75 — server

@grackle-ai/server: Unescaped Error String in renderPairingPage() HTML Template ### Impact The `renderPairingPage()` function embeds the `error` parameter directly into HTML without escaping: ```typescript const errorHtml = error ? `

${error}

` : ""; ``` All current call sites pass hardcoded strings, so this is **not exploitable today**. However, the function is architecturally fragile — if a future code change passes user-controlled or dynamic content into the error parameter, it would create an XSS vulnerability. The `renderAuthorizePage()` function in the same file correctly uses `escapeHtml()` for dynamic content, making this an inconsistency. **Affected code:** - `packages/server/src/index.ts:64-89` — `renderPairingPage()` with unescaped error interpolation - Compare: `packages/server/src/index.ts:130` — `renderAuthorizePage()` correctly uses `escapeHtml()` ### Patches v0.70.1 **Fix:** Apply `escapeHtml()` to the error parameter: ```typescript const errorHtml = error ? `

${escapeHtml(error)}

` : ""; ``` ### Workarounds No workaround needed — all current callers pass hardcoded strings. ### Resources - CWE-79: Improper Neutralization of Input During Web Page Generation - File: `packages/server/src/index.ts`