123 matches found
Powerline Gitstatus vulnerable to arbitrary code execution
powerline-gitstatus aka Powerline Gitstatus before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs gi...
PYSEC-2026-898 Powerline Gitstatus vulnerable to arbitrary code execution
powerline-gitstatus aka Powerline Gitstatus before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs gi...
@grackle-ai/cli (>=0.37.0, <=0.132.1), @grackle-ai/server (>=0.37.0, <=0.132.1) potentially affected by unknown CVE via @grackle-ai/powerline (>=0.37.0, <=0.132.1)
@grackle-ai/powerline NPM version =0.37.0, =0.37.0, =0.37.0, =0.132.1 Source cves: unknown CVE Source advisory: OSV:GHSA-VV65-F55V-XM6G...
Arbitrary Argument Injection
Overview @grackle-ai/powerline is a gRPC PowerLine server for Grackle AI agent integration Affected versions of this package are vulnerable to Arbitrary Argument Injection via unsanitized input to the branch parameter in the SpawnSession process. An attacker can execute arbitrary commands as the...
@grackle-ai/cli (>=0.37.0, <=0.132.2), @grackle-ai/server (>=0.37.0, <=0.132.2) potentially affected by unknown CVE via @grackle-ai/powerline (>=0.37.0, <=0.132.2)
@grackle-ai/powerline NPM version =0.37.0, =0.37.0, =0.37.0, =0.132.2 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAIPOWERLINE-17817937...
CVE-2025-59601
Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration...
EUVD-2025-210018
Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration...
CVE-2025-59601
Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration...
CVE-2025-59601 Exposure of Sensitive Information Through Metadata in Powerline Communication Firmware
Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration...
CVE-2025-59601
CVE-2025-59601 concerns devices with a Powerline interface where resetting to factory default exposes device configuration. The vulnerability enables Information Disclosure via the reset path, with an Adjacent attack vector, Low attack complexity, and no privileges required, resulting in High Con...
CVE-2025-59601 Exposure of Sensitive Information Through Metadata in Powerline Communication Firmware
Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration...
CVE-2025-59601: Exposure of Sensitive Information Through Metadata
Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration...
PT-2026-45628
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An information disclosure occurs when resetting a device to factory default settings via the powerline interface, which allows unauthorized access to the device...
@grackle-ai/cli (>=0.37.0, <=0.70.0), @grackle-ai/server (>=0.37.0, <=0.70.0) potentially affected by unknown CVE via @grackle-ai/powerline (>=0.37.0, <=0.70.0)
@grackle-ai/powerline NPM version =0.37.0, =0.37.0, =0.37.0, =0.70.0 Source cves: unknown CVE Source advisory: OSV:GHSA-XQ7H-VWJP-5VRH...
@grackle-ai/cli (>=0.37.0, <=0.70.0), @grackle-ai/server (>=0.37.0, <=0.70.0) potentially affected by unknown CVE via @grackle-ai/powerline (>=0.37.0, <=0.70.0)
@grackle-ai/powerline NPM version =0.37.0, =0.37.0, =0.37.0, =0.70.0 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAIPOWERLINE-15871386...
Missing Authentication for Critical Function
Overview @grackle-ai/powerline is a gRPC PowerLine server for Grackle AI agent integration Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the PowerLine gRPC server when when --token is not provided and GRACKLEPOWERLINETOKEN is not set. An...
@grackle-ai/powerline Runs Without Authentication by Default
Impact When --token is not provided and GRACKLEPOWERLINETOKEN is not set, the PowerLine gRPC server runs with zero authentication. A warning is logged "NO AUTH development only" but nothing prevents deployment in this state. Any client that can reach the PowerLine port can spawn agent sessions,...
GHSA-XQ7H-VWJP-5VRH @grackle-ai/powerline Runs Without Authentication by Default
Impact When --token is not provided and GRACKLEPOWERLINETOKEN is not set, the PowerLine gRPC server runs with zero authentication. A warning is logged "NO AUTH development only" but nothing prevents deployment in this state. Any client that can reach the PowerLine port can spawn agent sessions,...
PT-2026-30400
Impact When --token is not provided and GRACKLE POWERLINE TOKEN is not set, the PowerLine gRPC server runs with zero authentication. A warning is logged "NO AUTH development only" but nothing prevents deployment in this state. Any client that can reach the PowerLine port can spawn agent sessions,...