AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-cc2g-gq8c-r332: grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools

highvulnerabilityLLM-Specific

security

Source: GitHub Advisory DatabaseAugust 19, 2026

Summary

Several tools in grok-faf-mcp (a server that helps AI assistants work with project files) accept a file path argument from users without properly checking that the path stays within the intended project folder. This means an attacker could use path tricks like `../` or absolute paths to read any file on the system that the server process can access, including SSH keys, cloud credentials, or environment files. An LLM (large language model) could even be tricked via prompt injection (hiding instructions in user-supplied content like web pages or README files) into making these malicious file-read requests.

Solution / Mitigation

Fixed in version 1.5.3 by confining all user-supplied paths before accessing files: reads are restricted to `.faf` / `.fafm` context files only, general file operations are limited to the project root directory (with an override option via the `FAF_ALLOWED_ROOTS` environment variable), and paths are canonicalized through symlinks with absolute paths and `../` escapes rejected. Upgrade with: `npm install -g grok-faf-mcp@1.5.3` (or `bunx grok-faf-mcp`).