Executive brief
knowns is a tool that manages AI agent interactions, including a code.find feature that allows searching source files. A flaw in version 0.33.0 and earlier fails to properly restrict file access to the project directory, allowing attackers to read arbitrary files from the host system by supplying manipulated file paths. This could expose sensitive source code, configuration files, or other confidential data stored outside the intended project.
Technical details
The vulnerability is a path traversal flaw in the code.find MCP (Model Context Protocol) tool handler. The vulnerable component fails to validate and confine the path argument to the project root directory, allowing attackers to use absolute paths or relative traversal sequences (e.g., "../../../etc/passwd") to access files outside the intended scope. The attack requires control over the path argument supplied to the code.find tool, which is reachable by AI agent sessions interacting with knowns. An attacker can retrieve the full contents of arbitrary files on the host system. Patches are expected in versions after 0.33.0.
Affected products
- knowns-dev knowns through 0.33.0
Timeline
- 2026-09-10: disclosed