Executive brief
Knowns is a code collaboration and editing tool. Versions before 0.30.0 contain a path traversal vulnerability in the code replacement handler that allows attackers to write malicious content to arbitrary files outside the project directory, such as shell startup scripts or SSH configuration files, potentially gaining unauthorized system access or persistence.
Technical details
The vulnerability exists in the handleCodeReplace() function and allows path traversal attacks through insufficiently validated file paths. Attackers can supply absolute paths or paths containing directory traversal sequences (e.g., "../") to write files outside the intended project root. The vulnerability requires network access to the Knowns instance and the ability to invoke the code replacement function. An attacker can achieve arbitrary file write, potentially leading to code execution or system compromise. A fix was merged in commit a2c98fc and is expected to be available in version 0.30.0 or later.
Affected products
- Knowns Knowns before 0.30.0
Timeline
- 2026-09-07: disclosed: CVE-2026-86541 published
- 2026-08-16: patched: Security fix merged in commit a2c98fc (fix: guard code mutations)