{"action":"Upgrade claude-faf-mcp to 5.7.2 or later.","affected":[{"fixed":"5.7.2","introduced":"0"}],"component":"claude-faf-mcp","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["5.7.2"],"ghsa_id":"GHSA-rr55-jp92-8wp2","id":"tcs_01M5KG9QR3W5QPRSRHZS8BM645","modified_at":"2026-08-19T19:30:06.688222385Z","published_at":"2026-08-19T19:15:25Z","references":["https://osv.dev/vulnerability/GHSA-rr55-jp92-8wp2","https://github.com/Wolfe-Jam/claude-faf-mcp/security/advisories/GHSA-rr55-jp92-8wp2","https://github.com/Wolfe-Jam/claude-faf-mcp","https://github.com/Wolfe-Jam/claude-faf-mcp/releases/tag/v5.7.2"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-rr55-jp92-8wp2","url":"https://osv.dev/vulnerability/GHSA-rr55-jp92-8wp2"}],"summary":"claude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools"}