GHSA-7q9x-8g6p-3x75 @grackle-ai/server: Unescaped Error String in renderPairingPage() HTML Template

• npm @grackle-ai/server: < 0.70.1 → fixed in 0.70.1

Impact The `renderPairingPage()` function embeds the `error` parameter directly into HTML without escaping: ```typescript const errorHtml = error ? `${error}` : ""; ``` All current call sites pass hardcoded strings, so this is not exploitable today. However, the function is architecturally fragile — if a future code change passes user-controlled or dynamic content into the error parameter, it would create an XSS vulnerability. The `renderAuthorizePage()` function in the same file correctly uses `escapeHtml()` for dynamic content, making this an inconsistency. Affected code: • `packages/server/src/index.ts:64-89` — `renderPairingPage()` with unescaped error interpolation • Compare: `packages/server/src/index.ts:130` — `renderAuthorizePage()` correctly uses `escapeHtml()` Patches v0.70.1 Fix: Apply `escapeHtml()` to the error parameter: ```typescript const errorHtml = error ? `${escapeHtml(error)}` : ""; ``` Workarounds No workaround needed — all current callers pass hardcoded strings. Resources • CWE-79: Improper Neutralization of Input During Web Page Generation • File: `packages/server/src/index.ts`