Executive brief
faf-mcp is an MCP (Model Context Protocol) server tool used with AI coding assistants like Cursor and VS Code to provide persistent project context. The vulnerability allows attackers or prompt-injected LLMs to read sensitive files (SSH keys, cloud credentials, environment files) and write files outside the intended project directory by manipulating the path parameter. This could expose secrets stored on the developer's machine or allow modification of critical system files.
Technical details
This is a path traversal (CWE-22) and external control of file operations (CWE-73) vulnerability affecting faf-mcp versions ≤2.1.2. The affected tools (getProjectPath(), faf_read, faf_write) accept caller-controlled path arguments and resolve them using tilde expansion and path.resolve() without properly confining them to the intended project directory. An attacker or LLM prompt-injected via malicious content (web pages, README files, or .faf configuration) can issue tool calls with absolute paths or ../ traversals to read any file accessible to the server process (SSH keys, AWS credentials, /etc/passwd) or write arbitrary files. The vulnerability is reachable remotely through crafted tool calls over the MCP stdio protocol. The fix in version 2.1.3 confines all caller-supplied paths before filesystem access, canonicalizes paths through symlinks, and rejects absolute paths and directory escapes.
Affected products
- Wolfe-Jam faf-mcp <=2.1.2
Timeline
- 2026-08-19: disclosed
- 2026-08-19: patched: Fixed in version 2.1.3