GHSA-2r2p-4cgf-hv7h: engram HTTP Server CORS Wildcard + Vulnerability

HIGH
Share
CWE-1188 CWE-942 CWE-306 CWE-352
Published
Advisory Summary

GHSA-2r2p-4cgf-hv7h is a HIGH http server cors wildcard + vulnerability (CWE-1188: Initialization of a Resource with an Insecure Default) affecting engram libraries in the npm ecosystem. The issue involves http server cors wildcard + auth-off-by-default enables csrf graph exfiltration and persistent indirect prompt injection. Remediation is available by upgrading affected packages to version 2.0.2.

GHSA-2r2p-4cgf-hv7h at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-2r2p-4cgf-hv7h
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification CWE-1188: Initialization of a Resource with an Insecure Default
Affected Product engram
Package Ecosystem npm
Published Date
Last Updated

How to Fix GHSA-2r2p-4cgf-hv7h

To remediate this vulnerability, upgrade all affected engram dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

engramx fixed: 2.0.2 
npm install engramx@2.0.2
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls engramx

How to Check if You Are Affected

To determine whether your Node.js application is affected by GHSA-2r2p-4cgf-hv7h, inspect your project dependencies using npm:

npm ls engramx

Analyze the terminal output to locate any version of engram in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.0.2), your application is affected.

Note: The npm ls engramx command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-1188: Initialization of a Resource with an Insecure Default, where the product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure. In engram, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary The local HTTP server started by `engram server` (binding `127.0.0.1:7337` by default) was exposed to any browser origin with no authentication unless `ENGRAM_API_TOKEN` was explicitly set. Combined with `Access-Control-Allow-Origin: *` on every response and a body parser that did not require `Content-Type: application/json`, this allowed a malicious web page the developer visited to: 1. **Exfiltrate** the local knowledge graph via `GET /query` and `GET /stats` (function names, file layout, recorded decisions/mistakes). 2. **Inject persistent prompt-injection payloads** via `POST /learn`, which wrote `mistake`/`decision` nodes that were later surfaced as system-reminders to the user's AI coding agent on every future session and file edit. Severity: **High** — confidentiality + persistent indirect prompt injection against the user's coding agent. ### Affected versions `engramx` >= 1.0.0, < 2.0.2 — any version that shipped the HTTP server. ### Patched in `engramx@2.0.2` ### Workarounds (if you cannot upgrade) - Do **not** run `engram server` or `engram ui`. - If developers must, set `ENGRAM_API_TOKEN` to a long random value and terminate the server before browsing the web. ### Remediation (applied in 2.0.2) 1. Fail-closed auth on every non-public route — Bearer header or HttpOnly cookie, constant-time comparison, 256-bit auto-generated token at `~/.engram/http-server.token` (0600). 2. Wildcard CORS removed entirely; default is no CORS headers. Opt-in allowlist via `ENGRAM_ALLOWED_ORIGINS`. 3. Host + Origin validation — rejects DNS rebinding and Host spoofing. 4. `Content-Type: application/json` enforced on mutations — blocks the text/plain CSRF vector. 5. `/ui?token=` bootstrap with `Sec-Fetch-Site` gate — prevents cross-origin oracle probing. ### Credit Discovered and responsibly disclosed by @gabiudrescu in engram issue #7.

GHSA-2r2p-4cgf-hv7h Affected engram Versions

1 component(s)
Fixed Versions:
2.0.2
Product / Package Ecosystem Affected Versions Fixed Version
engramx
npm/engramx
npm
< 2.0.2
2.0.2

References

GitHub Advisory / Wiki ADVISORY
https://github.com/NickCirv/engram/security/advisories/GHSA-2r2p-4cgf-hv7h
engram Source Repository REPOSITORY
https://github.com/NickCirv/engram/issues/7
engram Source Repository REPOSITORY
https://github.com/NickCirv/engram

Frequently Asked Questions

What is GHSA-2r2p-4cgf-hv7h?
GHSA-2r2p-4cgf-hv7h is a security vulnerability in engram involving HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection under CWE-1188: Initialization of a Resource with an Insecure Default.
Which engram versions are affected?
Affected versions include releases prior to 2.0.2 across affected packages: engramx.
What version fixes GHSA-2r2p-4cgf-hv7h?
Upgrading to 2.0.2 (or the latest patched release for your respective branch) resolves the vulnerability.
Is engramx affected?
Yes, engramx is affected in releases prior to 2.0.2. Upgrade your dependency to 2.0.2 or later.
What CWE is associated with GHSA-2r2p-4cgf-hv7h?
GHSA-2r2p-4cgf-hv7h is classified under CWE-1188: Initialization of a Resource with an Insecure Default (The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.).
How can I check npm dependencies for GHSA-2r2p-4cgf-hv7h?
Run the dependency tree command: 'npm ls engramx'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2r2p-4cgf-hv7h",
  "modified" : "2026-04-22T14:52:03Z",
  "published" : "2026-04-22T14:52:03Z",
  "aliases" : [ ],
  "summary" : "engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection",
  "details" : "### Summary\n\nThe local HTTP server started by `engram server` (binding `127.0.0.1:7337` by default) was exposed to any browser origin with no authentication unless `ENGRAM_API_TOKEN` was explicitly set. Combined with `Access-Control-Allow-Origin: *` on every response and a body parser that did not require `Content-Type: application/json`, this allowed a malicious web page the developer visited to:\n\n1. **Exfiltrate** the local knowledge graph via `GET /query` and `GET /stats` (function names, file layout, recorded decisions/mistakes).\n2. **Inject persistent prompt-injection payloads** via `POST /learn`, which wrote `mistake`/`decision` nodes that were later surfaced as system-reminders to the user's AI coding agent on every future session and file edit.\n\nSeverity: **High** — confidentiality + persistent indirect prompt injection against the user's coding agent.\n\n### Affected versions\n\n`engramx` >= 1.0.0, < 2.0.2 — any version that shipped the HTTP server.\n\n### Patched in\n\n`engramx@2.0.2`\n\n### Workarounds (if you cannot upgrade)\n\n- Do **not** run `engram server` or `engram ui`.\n- If developers must, set `ENGRAM_API_TOKEN` to a long random value and terminate the server before browsing the web.\n\n### Remediation (applied in 2.0.2)\n\n1. Fail-closed auth on every non-public route — Bearer header or HttpOnly cookie, constant-time comparison, 256-bit auto-generated token at `~/.engram/http-server.token` (0600).\n2. Wildcard CORS removed entirely; default is no CORS headers. Opt-in allowlist via `ENGRAM_ALLOWED_ORIGINS`.\n3. Host + Origin validation — rejects DNS rebinding and Host spoofing.\n4. `Content-Type: application/json` enforced on mutations — blocks the text/plain CSRF vector.\n5. `/ui?token=` bootstrap with `Sec-Fetch-Site` gate — prevents cross-origin oracle probing.\n\n### Credit\n\nDiscovered and responsibly disclosed by @gabiudrescu in engram issue #7.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "engramx"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.0.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/NickCirv/engram/security/advisories/GHSA-2r2p-4cgf-hv7h"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/NickCirv/engram/issues/7"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/NickCirv/engram"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1188", "CWE-306", "CWE-352", "CWE-942" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-22T14:52:03Z",
    "nvd_published_at" : null
  }
}