Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
HIGH severity

GHSA-cc2g-gq8c-r332 — grok-faf-mcp

HIGH

GHSA-cc2g-gq8c-r332 is a high-severity (CVSS 7.5) vulnerability in grok-faf-mcp. A fix is available for grok-faf-mcp — see the affected versions and patch details below.

grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Aug 19, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

0other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
grok-faf-mcpnpm
440downloads / week

Description

Summary

Several grok-faf-mcp MCP tools accept a caller-controlled path argument and resolve it (~ expansion + path.resolve()) straight into a filesystem read without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be made to read files outside the intended .faf project context. The only remaining limit is OS file permissions.

Affected tools

refresh_faf, faf_score, faf_get_orchestration_policy, refresh_blend (and the shared getProjectPath() chokepoint feeding the .faf tools), plus the general-purpose faf_read / faf_write file tools (denylist-only; an absolute path still reached home-directory secrets, and faf_write could write outside the project). refresh_faf echoes the file contents verbatim back to the caller as "fresh DNA"; faf_get_orchestration_policy reflects values parsed out of the attacker-chosen file and echoes the resolved absolute path — confirming the read.

Impact

An MCP client — or an LLM prompt-injected via attacker-controlled content (a web page, README, ticket, or .faf) into issuing a tool call — can read any file the server process can read: SSH keys (~/.ssh/id_rsa), cloud credentials (~/.aws/credentials), .env files, source, /etc/passwd. This is a sensitive-information-disclosure (CWE-200) primitive that far exceeds the declared .faf project-context scope. The server runs over stdio, so the read is reached by a crafted tool call (e.g. a prompt-injected agent processing attacker-controlled content).

Patches

Fixed in 1.5.3 by confining every caller-supplied path before any filesystem access (safe-path.ts):

  • Reads are restricted to .faf / .fafm context files, so non-context files (secrets) are refused regardless of directory.
  • General file ops (faf_read / faf_write) are confined to the project root (cwd + system temp; override with FAF_ALLOWED_ROOTS).
  • Paths are canonicalized through symlinks (closing the symlink bypass); absolute paths and ../ escapes are rejected.

Upgrade: npm install -g [email protected] (or bunx grok-faf-mcp).

Workarounds

If you cannot upgrade immediately, run the server only against trusted local projects, and set FAF_ALLOWED_ROOTS (patched versions) to a single project directory for a hard directory boundary.

Credits

Discovered and responsibly reported via coordinated disclosure by Zhihao Zhang (Worcester Polytechnic Institute).

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npmgrok-faf-mcpall versions1.5.3npm install grok-faf-mcp@1.5.3

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for grok-faf-mcp, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update grok-faf-mcp to 1.5.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-cc2g-gq8c-r332 is resolved across your whole dependency graph.

  3. Workarounds

    Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.

Frequently Asked Questions

### Summary Several `grok-faf-mcp` MCP tools accept a caller-controlled `path` argument and resolve it (`~` expansion + `path.resolve()`) straight into a filesystem read **without confining it to a trusted project directory**. An absolute path or `../` traversal is resolved and used as-is, so the server process can be made to read files outside the intended `.faf` project context. The only remaining limit is OS file permissions. ### Affected tools `refresh_faf`, `faf_score`, `faf_get_orchestration_policy`, `refresh_blend` (and the shared `getProjectPath()` chokepoint feeding the `.faf` tools)
O3 Security · Impact-Aware SCA

Is GHSA-cc2g-gq8c-r332 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
GHSA-cc2g-gq8c-r332: grok-faf-mcp | O3 Security