HIGHnpm
GHSA-vv65-f55v-xm6gGrackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true)
Modified: 9/10/2026
package
npm/@grackle-ai/powerline
pkg:npm/%40grackle-ai/powerline
MEDIUMnpm
GHSA-xq7h-vwjp-5vrh@grackle-ai/powerline Runs Without Authentication by Default
Modified: 3/25/2026