How severe is GHSA-j4r7-8ph4-43g3?

GHSA-j4r7-8ph4-43g3 has a CVSS score of 7.5/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by GHSA-j4r7-8ph4-43g3?

GHSA-j4r7-8ph4-43g3 affects the following packages: faf-mcp (npm). Ecosystems affected: npm.

How do I fix GHSA-j4r7-8ph4-43g3?

Update faf-mcp to 2.1.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-j4r7-8ph4-43g3 is resolved across your whole dependency graph.

How do I detect GHSA-j4r7-8ph4-43g3 in my npm dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for faf-mcp, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-j4r7-8ph4-43g3 if there is no patch (or I can't update yet)?

Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.

Is GHSA-j4r7-8ph4-43g3 actively exploited in the wild?

No public exploit code has been indexed for GHSA-j4r7-8ph4-43g3 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-j4r7-8ph4-43g3 published, and has it been updated?

GHSA-j4r7-8ph4-43g3 was published on August 19, 2026 and was last updated on August 19, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦

📦 npm

Not in CISA KEV

HIGH severity

GHSA-j4r7-8ph4-43g3 — faf-mcp

HIGH

GHSA-j4r7-8ph4-43g3 is a high-severity (CVSS 7.5) vulnerability in faf-mcp. A fix is available for faf-mcp — see the affected versions and patch details below.

faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

Published

Aug 19, 2026

Updated

Aug 19, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Aug 19, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

0other npm packages depend on this — each one inherits the vulnerability until it's patched upstream

faf-mcpnpm

240downloads / week

Description

Summary

faf-mcp MCP tools accept a caller-controlled path argument and resolve it (~ expansion + path.resolve()) straight into a filesystem read/write without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be made to read — and, via the file tools, write — files outside the intended .faf project context. The only remaining limit is OS file permissions.

Affected tools

The shared getProjectPath() chokepoint (feeding the .faf tools) and the general-purpose faf_read / faf_write file tools resolved a caller path straight into a read/write with no confinement (denylist-only); an absolute path still reached home-directory secrets, and faf_write could write outside the project.

Impact

An MCP client — or an LLM prompt-injected via attacker-controlled content (a web page, README, ticket, or .faf) into issuing a tool call — can read any file the server process can read: SSH keys (~/.ssh/id_rsa), cloud credentials (~/.aws/credentials), .env files, source, /etc/passwd; and faf_write could write outside the project. This is a sensitive-information-disclosure (CWE-200) primitive that far exceeds the declared .faf project-context scope. The server runs over stdio, so the read/write is reached by a crafted tool call (e.g. a prompt-injected agent processing attacker-controlled content).

Patches

Fixed in 2.1.3 by confining every caller-supplied path before any filesystem access (safe-path.ts):

Reads are restricted to .faf / .fafm context files, so non-context files (secrets) are refused regardless of directory.
General file ops (faf_read / faf_write) are confined to the project root (cwd + system temp; override with FAF_ALLOWED_ROOTS).
Paths are canonicalized through symlinks (closing the symlink bypass); absolute paths and ../ escapes are rejected; callTool() gains a central PATH-DENIED guard.

Upgrade: npm install -g [email protected] (or npx faf-mcp).

Workarounds

If you cannot upgrade immediately, run the server only against trusted local projects, and set FAF_ALLOWED_ROOTS (patched versions) to a single project directory for a hard directory boundary.

Credits

Identified by the maintainers during a sibling-server audit prompted by the coordinated disclosure of the same class of issue in grok-faf-mcp by Zhihao Zhang (Worcester Polytechnic Institute).

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
📦npm	`faf-mcp`	all versions	2.1.3`npm install faf-mcp@2.1.3`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for faf-mcp, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update faf-mcp to 2.1.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-j4r7-8ph4-43g3 is resolved across your whole dependency graph.
Workarounds
Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.

Frequently Asked Questions

### Summary `faf-mcp` MCP tools accept a caller-controlled `path` argument and resolve it (`~` expansion + `path.resolve()`) straight into a filesystem read/write **without confining it to a trusted project directory**. An absolute path or `../` traversal is resolved and used as-is, so the server process can be made to read — and, via the file tools, write — files outside the intended `.faf` project context. The only remaining limit is OS file permissions. ### Affected tools The shared `getProjectPath()` chokepoint (feeding the `.faf` tools) and the general-purpose `faf_read` / `faf_write` fi

O3 Security · Impact-Aware SCA

Is GHSA-j4r7-8ph4-43g3 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works