Executive brief
Knowns is a tool used to manage documentation and project data for AI agents. A security flaw allows an attacker to trick the system into creating folders and markdown files in unauthorized locations on the computer's storage. While the attacker cannot run malicious code or overwrite existing files, they can clutter the system or potentially manipulate how the AI agent views the project structure.
Technical details
A directory traversal vulnerability exists in knowns-dev/knowns 0.11.4 within the 'create_doc' MCP tool. The 'folder' parameter in the tool handler only strips leading and trailing slashes but fails to sanitize '../' sequences, allowing an attacker to escape the intended '.knowns/docs/' directory. While the file extension is hardcoded to '.md' and existing files cannot be overwritten, an attacker can create arbitrary directories and write markdown files to any writable location on the filesystem. This can be further exploited by chaining with the 'set_project' tool to hijack the project root by creating a malicious '.knowns/' structure in a new location.
Affected products
- knowns-dev knowns 0.11.4
Timeline
- 2026-02-12: other: Vulnerability discovered and PoC created
- 2026-07-21: disclosed: CVE published