Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

grok-faf-mcp

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5npmPublished

    grok-faf-mcp has an arbitrary local file read via unconfined path argument in FAF tools

    GHSA-cc2g-gq8c-r332

    Affected
    • npm grok-faf-mcp <= 1.5.2
    Fixed in
    1.5.3· Vendor fix available
    Issue
    Several grok-faf-mcp MCP tools accept a caller-controlled path argument and resolve it (~ expansion + path.resolve()) straight into a filesystem read without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be made to read files outside the intended .faf project context. The only remaining limit is OS file permissions. Affected tools refreshfaf, fafscore, fafgetorchestrationpolicy, refreshblend (and the shared getProjectPath() chokepoint feeding the .faf tools), plus the general-purpose fafread / fafwrite file tools (denylist-only; an absolute path still reached home-directory secrets, and fafwrite could write outside the project). refreshfaf echoes the file contents verbatim back to the caller as "fresh DNA"; fafgetorchestrationpolicy reflects values parsed out of the attacker-chosen file and echoes the resolved absolute path — confirming the read. Impact An MCP client — or an LLM…

    Recommended action: Upgrade to 1.5.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →