AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-rr55-jp92-8wp2: claude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

highvulnerabilityLLM-Specific

security

Source: GitHub Advisory DatabaseAugust 19, 2026

Summary

claude-faf-mcp (a tool that helps Claude interact with projects) had a security flaw where it didn't properly limit which files users could read or write. An attacker could use prompt injection (tricking the AI by hiding instructions in user input) to read sensitive files like SSH keys or cloud credentials stored outside the intended project folder. The vulnerability affected file-reading and file-writing tools that accepted file paths without proper restrictions.

Solution / Mitigation

Fixed in version 5.7.2 by adding path confinement that restricts file access to the project directory. Users should upgrade by running: `npm install -g claude-faf-mcp@5.7.2`. The fix also rejects absolute paths and directory-traversal attempts (like `../`). As a temporary workaround before upgrading, set the `FAF_ALLOWED_ROOTS` environment variable to limit operations to a single trusted project directory.