{"data":{"id":"6f4e26a7-b2b8-4588-b20c-ffe4099e4e15","title":"GHSA-j4r7-8ph4-43g3: faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools","summary":"faf-mcp (a tool that helps AI assistants work with files) had a security flaw where it accepted file paths from callers without properly restricting access to a safe directory. This meant an attacker could trick the system into reading sensitive files like SSH keys or cloud credentials, or writing files outside the intended project folder, by using absolute paths or directory-traversal tricks (like `../`). The vulnerability could be exploited through prompt injection (hiding malicious instructions in user-provided content that an AI processes).","solution":"Fixed in version 2.1.3 by adding path confinement: reads are restricted to `.faf` / `.fafm` context files only, general file operations are confined to the project root (with an optional `FAF_ALLOWED_ROOTS` environment variable to override), symlink bypasses are closed, and absolute paths and `../` escapes are rejected. Upgrade with `npm install -g faf-mcp@2.1.3` or use `npx faf-mcp`. If you cannot upgrade immediately, run the server only on trusted local projects and set `FAF_ALLOWED_ROOTS` to a single project directory for a hard boundary.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-j4r7-8ph4-43g3","publishedAt":"2026-08-19T19:15:13.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["pii_leakage","prompt_injection"],"issueType":"vulnerability","affectedPackages":["faf-mcp@<= 2.1.2 (fixed: 2.1.3)"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["faf-mcp"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":true,"disclosureDate":"2026-08-19T19:15:13.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":null}}