knowns through 0.33.0 Path Traversal via Template Engine
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 0.5%
exploitation probability
0.5%top 57% of all CVEs
observed exploitation
nono source reports it
knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside the project root. Attackers can supply malicious templates that traverse directories to overwrite shell profiles, steal credentials, or achieve persistent code execution on victim systems.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
knowns-dev · knownsReferences
https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/codegen/template_engine.go#L318-L344https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/codegen/template_engine.go#L625-L636https://github.com/knowns-dev/knowns/security/advisories/GHSA-68cq-4rwm-f7jrhttps://github.com/knowns-dev/knowns/security/advisories/GHSA-xjcg-5j3r-m6f9https://www.vulncheck.com/advisories/knowns-through-0.33.0-path-traversal-via-template-engine