Executive brief
knowns is a code generation tool that uses templates to create project files. A flaw in template path validation allows attackers to supply malicious templates that write files outside the intended project directory—such as shell configuration files or credentials—leading to data theft or persistent code execution on a developer's machine.
Technical details
The template engine in knowns through version 0.33.0 fails to properly validate destination paths in code generation templates, enabling directory traversal attacks. The vulnerable component is in internal/codegen/template_engine.go. An attacker can craft a malicious template with path traversal sequences (e.g., ../../../) to write arbitrary files to locations outside the project root, including user home directories. No authentication or special privileges are required—an attacker simply needs to convince a developer to use a malicious template. This can result in overwriting shell profiles (.bashrc, .zshrc), stealing SSH keys or credentials, or achieving persistent code execution. A patch is expected in version 0.33.1 or later.
Affected products
- knowns-dev knowns through 0.33.0
Timeline
- 2026-09-10: disclosed