Faf-Mcp (<= 2.1.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/faf-mcp--2.1.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 19 Aug 2026 22:34:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgArbitrary Local File Read and Write in faf-mcphttps://feed.craftedsignal.io/briefs/2026-08-faf-mcp-path-traversal/Wed, 19 Aug 2026 22:34:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-faf-mcp-path-traversal/The faf-mcp package contains an arbitrary local file read/write vulnerability due to failure to validate user-supplied path arguments, allowing attackers to access or modify sensitive files outside the project directory.The faf-mcp package (versions 2.1.2 and earlier) contains a critical path traversal vulnerability caused by the insecure handling of the path argument in its MCP (Model Context Protocol) tools. The application resolves caller-provided paths using ~ expansion and path.resolve() without confining them to a trusted project directory. This flaw allows an attacker to bypass intended directory restrictions using absolute paths or directory traversal sequences (../). By sending crafted tool calls via an MCP client, an attacker can read sensitive files, such as SSH keys, AWS credentials, or system configuration files, and overwrite files on the host system where the faf-mcp server process has sufficient permissions. This vulnerability was identified during a security audit and is remediated in version 2.1.3 through robust path canonicalization and directory confinement.

Impact

Successful exploitation allows an attacker to perform unauthorized file system operations, leading to potential credential theft, information disclosure, and system compromise. Attackers can reach critical files such as ~/.ssh/id_rsa, ~/.aws/credentials, and /etc/passwd. Because the server operates over stdio and responds to tool calls, this vulnerability is highly susceptible to exploitation through LLM prompt injection, where an agent processing malicious external content is coerced into executing these unauthorized file operations.

Recommendation

  • Upgrade to faf-mcp version 2.1.3 or later immediately to apply the path confinement logic in safe-path.ts.
  • If upgrading is not immediately feasible, restrict the use of the server to trusted environments and define the FAF_ALLOWED_ROOTS environment variable to explicitly bound access to a single, low-risk project directory.
  • Implement endpoint monitoring to detect unauthorized file access patterns from the faf-mcp process (or the parent node process) targeting sensitive configuration paths outside the expected working directory.
]]>highadvisory