Executive brief
knowns is a development tool that manages language server configuration for code editors. Versions before 0.30.0 fail to validate binary paths in project configuration files, allowing attackers to execute arbitrary programs with the user's privileges by committing a malicious configuration file to a repository. When a developer opens the repository, the attacker's binary is executed twice without any user warning or confirmation.
Technical details
The vulnerability is a failure to validate the settings.lsp.languages binary field in .knowns/config.json project configuration files. The vulnerable code in internal/lsp/detect.go executes the binary path specified in the configuration without sanitizing or verifying it first. The attack vector is local/adjacent: an attacker commits a crafted .knowns/config.json to a shared repository; when any developer clones and opens the repository with knowns, the unvalidated binary path from the config is executed under the user's account. The attacker achieves arbitrary code execution under the developer's privileges. The issue was patched in version 0.30.0.
Affected products
- knowns-dev knowns before 0.30.0
Timeline
- 2026-09-07: disclosed
- 0.30.0: patched