Executive brief
Knowns is an AI agent framework that manages file operations through API endpoints. A flaw in request header validation allows unauthenticated remote attackers to specify arbitrary filesystem paths, bypassing sandbox restrictions and granting unrestricted access to the host system's files and directories.
Technical details
The vulnerability is an external control of file name or path (CWE-73) flaw in the /api/opencode proxy endpoint. The server fails to properly validate the x-opencode-directory request header, allowing attackers to inject arbitrary directory paths. An unauthenticated remote attacker can exploit this over the network with low complexity to execute file operations outside the project root directory, achieving full confidentiality, integrity, and availability compromise of the host filesystem. Versions before 0.31.0 are affected; a patch is available in version 0.31.0 or later.
Affected products
- Knowns Knowns < 0.31.0
Timeline
- 2026-09-10: disclosed
- 2026-09-10: advisory: GHSA-w47m-jpv2-qfw5 published; marked as duplicate of GHSA-9h2q-r9fh-f98w
- 2026-09-10: patched: Fix released in v0.31.0