Executive brief
Grok-faf-mcp is an MCP (Model Context Protocol) tool used by LLM agents to manage project files and configurations. The tool fails to properly validate file paths supplied by clients, allowing attackers to read sensitive files outside the intended project directory—such as SSH keys, cloud credentials, and environment files—via path traversal or absolute paths. An attacker who can inject tool calls (through prompt injection in web pages, documentation, or configuration files) can steal credentials and secrets accessible to the server process.
Technical details
The vulnerability is a path traversal / arbitrary file read (CWE-22, CWE-73) in multiple grok-faf-mcp tools: `refresh_faf`, `faf_score`, `faf_get_orchestration_policy`, `refresh_blend`, and the general-purpose `faf_read` / `faf_write` functions. These tools accept a caller-controlled `path` argument and resolve it using tilde expansion and `path.resolve()` without confining the result to a trusted project directory. An attacker can supply an absolute path (e.g. `/etc/passwd`, `~/.ssh/id_rsa`) or use `../` sequences to escape the intended `.faf` project context. The server runs over stdio and processes tool calls from an MCP client, making it vulnerable to prompt injection: an attacker can embed malicious tool calls in attacker-controlled content (web pages, README files, configuration files) that gets processed by an LLM agent, causing the server to read and echo back arbitrary files. The only remaining limit is OS file permissions on the server process. Fixed in version 1.5.3 by implementing strict path confinement in `safe-path.ts`, which restricts reads to `.faf` / `.fafm` context files, confines general file operations to the project root, canonicalizes symlinks, and rejects absolute paths and traversal sequences.
Affected products
- Wolfe-Jam grok-faf-mcp <= 1.5.2
Timeline
- 2026-06-11: disclosed: Advisory published to GitHub Advisory Database
- 2026-06-11: patched: Version 1.5.3 released with path confinement fix
- 2026-08-19: advisory: Advisory reviewed and updated in GitHub Advisory Database