{"action":"Upgrade @grackle-ai/mcp to 0.70.2 or later.","affected":[{"fixed":"0.70.2","introduced":"0"}],"component":"@grackle-ai/mcp","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["0.70.2"],"ghsa_id":"GHSA-647h-p824-99w7","id":"tcs_01M5KF5HSFD5WPKKCN9ME9BF2A","modified_at":"2026-03-25T17:32:56.686228Z","published_at":"2026-03-25T17:23:11Z","references":["https://osv.dev/vulnerability/GHSA-647h-p824-99w7","https://github.com/nick-pape/grackle/security/advisories/GHSA-647h-p824-99w7","https://github.com/nick-pape/grackle"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-647h-p824-99w7","url":"https://osv.dev/vulnerability/GHSA-647h-p824-99w7"}],"summary":"@grackle-ai/mcp has a workspace authorization bypass in its knowledge_search MCP tool"}