{"action":"Upgrade grok-faf-mcp to 1.5.3 or later.","affected":[{"fixed":"1.5.3","introduced":"0"}],"component":"grok-faf-mcp","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["1.5.3"],"ghsa_id":"GHSA-cc2g-gq8c-r332","id":"tcs_01M5KFJB5C3S6WXME6YXEMSBRX","modified_at":"2026-08-19T19:30:06.695627566Z","published_at":"2026-08-19T19:15:01Z","references":["https://osv.dev/vulnerability/GHSA-cc2g-gq8c-r332","https://github.com/Wolfe-Jam/grok-faf-mcp/security/advisories/GHSA-cc2g-gq8c-r332","https://github.com/Wolfe-Jam/grok-faf-mcp","https://github.com/Wolfe-Jam/grok-faf-mcp/releases/tag/v1.5.3"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-cc2g-gq8c-r332","url":"https://osv.dev/vulnerability/GHSA-cc2g-gq8c-r332"}],"summary":"grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools"}