CVE-2026-86540
highknowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary…
knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/lsp/detect.go#L128-L157 disclosure@vulncheck.com
- https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/models/config.go#L205-L216 disclosure@vulncheck.com
- https://github.com/knowns-dev/knowns/commit/d3989829fb5095666d23d005b2f78a082832a396 disclosure@vulncheck.com
- https://github.com/knowns-dev/knowns/releases/tag/v0.30.0 disclosure@vulncheck.com
- https://github.com/knowns-dev/knowns/security/advisories/GHSA-mc52-mwq4-vfx3 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/knowns-before-0.30.0-arbitrary-code-execution-via-lsp... disclosure@vulncheck.com