A GitHub Security Advisory reports a high-severity vulnerability affecting grok-faf-mcp versions <= 1.5.2 in the grok-faf-mcp toolset. The issue allows for arbitrary local file reads via an unconfined path argument in FAF tools. Affected tools include refresh_faf, faf_score, and others. An MCP client can read any file the server process can access, including sensitive information such as SSH keys and cloud credentials. The vulnerability is due to the fact that FAF tools resolve caller-controlled paths straight into a filesystem read without confining them to a trusted project directory. Absolute paths or../ traversals are resolved and used as-is, allowing the server process to read files outside the intended.faf project context. The only remaining limit is OS file permissions. The issue was fixed in version 1.5.3 by confining every caller-supplied path before any filesystem access. Reads are restricted to.faf /.fafm context files, and general file ops are confined to the project root. Paths are also canonicalized through symlinks, closing the symlink bypass.
We recommend you to update grok-faf-mcp to version 1.5.3.[/subscribe_to_unlock_form]
A GitHub Security Advisory reports a high-severity vulnerability affecting grok-faf-mcp versions <= 1.5.2 in the grok-faf-mcp toolset. The issue allows for arbitrary local file reads via an unconfined path argument in FAF tools. Affected tools include refresh_faf, faf_score, and others. An MCP client can read any file the server process can access, including sensitive information such as SSH keys and cloud credentials. The vulnerability is due to the fact that FAF tools resolve caller-controlled paths straight into a filesystem read without confining them to a trusted project directory. Absolute paths or../ traversals are resolved and used as-is, allowing the server process to read files outside the intended.faf project context. The only remaining limit is OS file permissions. The issue was fixed in version 1.5.3 by confining every caller-supplied path before any filesystem access. Reads are restricted to.faf /.fafm context files, and general file ops are confined to the project root. Paths are also canonicalized through symlinks, closing the symlink bypass.
We recommend you to update grok-faf-mcp to version 1.5.3.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]