5vulnerabilities
- Critical1 (20.0%)
- High4 (80.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
knowns
Ecosystem: npm
Downloads: 867
- 1CriticalAffects 1 version
- 4HighAffects 4 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 4 vulnerabilities
- Critical: 1
- High: 3
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (5)
Known vulnerabilities affecting knowns, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-mc52-mwq4-vfx3 | High | knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json## Overview A critical **Arbitrary Code Execution (ACE)** vulnerability exists in the Knowns Language Server Protocol (LSP) detection and startup pipeline. The system blindly trusts the `settings.lsp.languages.<lang>.binary` field defined in the project-level `.knowns/config.json` file. Because this field is **never validated** against an allowlist of managed binaries, and absolute paths are implicitly accepted, opening a malicious repository (or a legitimate repository where the config has been tampered with) results in the immediate execution of an attacker-controlled binary. The payload |
| GitHub (opens in a new tab) | |
| GHSA-9gfj-28hw-jchp | High | Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools## Overview Verified. Multiple **Unrestricted Path Traversal** vulnerabilities exist in the Knowns MCP `docs` and `memory` tools, allowing arbitrary file read, write, and deletion operations outside the project sandbox. The storage layer functions (`Get`, `Create`, `Update`, `Rename`, `Delete`) in both `doc_store.go` and `memory_store.go` concatenate user-controlled paths with `filepath.Join()` without any containment validation. Additionally, the `docs.update` action with a `newPath` parameter performs a file deletion via `Rename()`, but is classified as `CapWrite` in the permission regist |
| GitHub (opens in a new tab) | |
| GHSA-w47m-jpv2-qfw5 | Critical | Duplicate Advisory: Knowns Sandbox Escape: Unauthenticated Header Injection Grants AI Agent Unrestricted Access to Host Filesystem### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9h2q-r9fh-f98w. This link is maintained to preserve external references. ### Original Description knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system. |
| GitHub (opens in a new tab) | |
| GHSA-6ph4-r249-58p2 | High | Duplicate Advisory: knowns vulnerable to command injection# Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mc52-mwq4-vfx3. This link is maintained to preserve external references. # Original Description knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification. |
| GitHub (opens in a new tab) | |
| GHSA-qjrq-cvv4-3g9w | High | Duplicate Advisory: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9gfj-28hw-jchp. This link is maintained to preserve external references. ## Original Advisory knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files accessible to the server process. |
| GitHub (opens in a new tab) |
- GHSA-mc52-mwq4-vfx3Highknowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json
< 0.30.0
## Overview A critical **Arbitrary Code Execution (ACE)** vulnerability exists in the Knowns Language Server Protocol (LSP) detection and startup pipeline. The system blindly trusts the `settings.lsp.languages.<lang>.binary` field defined in the project-level `.knowns/config.json` file. Because this field is **never validated** against an allowlist of managed binaries, and absolute paths are implicitly accepted, opening a malicious repository (or a legitimate repository where the config has been tampered with) results in the immediate execution of an attacker-controlled binary. The payload
CVE: CVE-2026-86540
- GHSA-9gfj-28hw-jchpHighKnowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools
< 0.30.0
## Overview Verified. Multiple **Unrestricted Path Traversal** vulnerabilities exist in the Knowns MCP `docs` and `memory` tools, allowing arbitrary file read, write, and deletion operations outside the project sandbox. The storage layer functions (`Get`, `Create`, `Update`, `Rename`, `Delete`) in both `doc_store.go` and `memory_store.go` concatenate user-controlled paths with `filepath.Join()` without any containment validation. Additionally, the `docs.update` action with a `newPath` parameter performs a file deletion via `Rename()`, but is classified as `CapWrite` in the permission regist
CVE: CVE-2026-86439
- GHSA-w47m-jpv2-qfw5CriticalDuplicate Advisory: Knowns Sandbox Escape: Unauthenticated Header Injection Grants AI Agent Unrestricted Access to Host Filesystem
all
### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9h2q-r9fh-f98w. This link is maintained to preserve external references. ### Original Description knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system.
- GHSA-6ph4-r249-58p2HighDuplicate Advisory: knowns vulnerable to command injection
< 0.30.0
# Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mc52-mwq4-vfx3. This link is maintained to preserve external references. # Original Description knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.
- GHSA-qjrq-cvv4-3g9wHighDuplicate Advisory: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools
all
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9gfj-28hw-jchp. This link is maintained to preserve external references. ## Original Advisory knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files accessible to the server process.