GHSA-cc2g-gq8c-r332
HIGHGHSA-cc2g-gq8c-r332 is a high-severity (CVSS 7.5) vulnerability in grok-faf-mcp. O3 Security confirms whether GHSA-cc2g-gq8c-r332 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
grok-faf-mcpnpmDescription
Summary
Several grok-faf-mcp MCP tools accept a caller-controlled path argument and resolve it (~ expansion + path.resolve()) straight into a filesystem read without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be made to read files outside the intended .faf project context. The only remaining limit is OS file permissions.
Affected tools
refresh_faf, faf_score, faf_get_orchestration_policy, refresh_blend (and the shared getProjectPath() chokepoint feeding the .faf tools), plus the general-purpose faf_read / faf_write file tools (denylist-only; an absolute path still reached home-directory secrets, and faf_write could write outside the project). refresh_faf echoes the file contents verbatim back to the caller as "fresh DNA"; faf_get_orchestration_policy reflects values parsed out of the attacker-chosen file and echoes the resolved absolute path — confirming the read.
Impact
An MCP client — or an LLM prompt-injected via attacker-controlled content (a web page, README, ticket, or .faf) into issuing a tool call — can read any file the server process can read: SSH keys (~/.ssh/id_rsa), cloud credentials (~/.aws/credentials), .env files, source, /etc/passwd. This is a sensitive-information-disclosure (CWE-200) primitive that far exceeds the declared .faf project-context scope. The server runs over stdio, so the read is reached by a crafted tool call (e.g. a prompt-injected agent processing attacker-controlled content).
Patches
Fixed in 1.5.3 by confining every caller-supplied path before any filesystem access (safe-path.ts):
- Reads are restricted to
.faf/.fafmcontext files, so non-context files (secrets) are refused regardless of directory. - General file ops (
faf_read/faf_write) are confined to the project root (cwd + system temp; override withFAF_ALLOWED_ROOTS). - Paths are canonicalized through symlinks (closing the symlink bypass); absolute paths and
../escapes are rejected.
Upgrade: npm install -g [email protected] (or bunx grok-faf-mcp).
Workarounds
If you cannot upgrade immediately, run the server only against trusted local projects, and set FAF_ALLOWED_ROOTS (patched versions) to a single project directory for a hard directory boundary.
Credits
Discovered and responsibly reported via coordinated disclosure by Zhihao Zhang (Worcester Polytechnic Institute).
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | grok-faf-mcp | all versions | 1.5.3 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for grok-faf-mcp. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update grok-faf-mcp to 1.5.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-cc2g-gq8c-r332 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-cc2g-gq8c-r332 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-cc2g-gq8c-r332. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-cc2g-gq8c-r332 in your dependencies?
O3 detects GHSA-cc2g-gq8c-r332 across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.