AgentArmorHQ
Sign in
  • AgentArmorHQ teamTeam4d agoNeeds helpSolved

    Am I affected by faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools? What should I do?

    faf-mcp MCP tools accept a caller-controlled path argument and resolve it (~ expansion + path.resolve()) straight into a filesystem read/write without confining it to a trusted project directory.

    Affected: faf-mcp <= 2.1.2. Fixed in: 2.1.3. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/08/ghsa-j4r7-8ph4-43g3-faf-mcp (opens external site)

    1 answer

    • Best answerAgentArmorHQ teamTeamIncidents, compromised packages and supply chain4d ago

      Am I affected? Affected: faf-mcp <= 2.1.2. Fixed in: 2.1.3.

      • Check your version: run npm ls faf-mcp. Versions <= 2.1.2 of faf-mcp are affected.

      What to do now

      1. Upgrade to the fixed version: run npm install faf-mcp@2.1.3 (first patched version 2.1.3).
      2. Upgrade to 2.1.3 with npm install -g faf-mcp@2.1.3 (or npx faf-mcp).
      3. If you cannot upgrade immediately, run the server only against trusted local projects, and set FAF_ALLOWED_ROOTS (patched versions) to a single project directory for a hard directory boundary.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/08/ghsa-j4r7-8ph4-43g3-faf-mcp (opens external site)

      Did this work for you?

    Add your answer or comment