Executive brief
Knowns is an AI agent platform and project management tool. Versions before 0.31.0 fail to properly validate request headers in an internal proxy endpoint, allowing remote attackers to specify arbitrary directory paths and perform file operations outside the intended project directory on the host system.
Technical details
The vulnerability is a path traversal flaw in the /api/opencode proxy endpoint in Knowns versions before 0.31.0. The vulnerable component fails to properly validate the x-opencode-directory request header, allowing attackers to supply arbitrary directory paths. This enables execution of file operations outside the project root on the host system. The endpoint is network-reachable and no authentication is mentioned as a prerequisite. Attackers can exploit this to read, modify, or delete files on the host system. The issue was patched in version 0.31.0 (released 2026-08-19 based on commit context, with public disclosure 2026-09-10).
Affected products
- knowns-dev Knowns before 0.31.0
Timeline
- 2026-09-10: disclosed: CVE-2026-88899 published on NVD