CVE-2026-86540highCWE-78

CVE-2026-86540: falha de alta gravidade em knowns-dev knowns

knowns before 0.30.0 Arbitrary Code Execution via LSP Binary

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar knowns+ Monitorar knowns

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.5epss 0.2%
knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
knowns-dev · knowns
CVEs relacionadas — knowns-dev knowns

No mesmo produto, das mais perigosas para as menos.

CVE-2026-86439HIGHknowns before 0.30.0 Path Traversal via MCP doc and memory toolsEPSS 1.1%CVE-2026-86538HIGHknowns before 0.30.0 Path Traversal via templateFile parameterEPSS 1.0%CVE-2026-86543CRITICALknowns before 0.30.0 Unauthenticated Management API ExposureEPSS 0.9%CVE-2026-88899CRITICALknowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory HeaderEPSS 0.8%CVE-2026-86541HIGHknowns before 0.30.0 Path Traversal via code.replace MCP actionEPSS 0.8%CVE-2026-86775HIGHknowns before 0.30.0 Path Traversal via Document APIEPSS 0.7%