CVE-2026-86439

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-86439

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86439.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-86439

Aliases

GHSA-9gfj-28hw-jchp

Published

2026-09-07T23:03:16Z

Modified

2026-09-12T03:30:52Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

knowns before 0.30.0 Path Traversal via MCP doc and memory tools

Details

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files accessible to the server process.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86439.json"
}

References

Affected packages

Git / github.com/knowns-dev/knowns

Affected ranges

Type

GIT

Repo

https://github.com/knowns-dev/knowns

Events

Introduced

Fixed

cead30b2c3a34f66c0c40cb692ed51e588e63bd7

Fixed

09c5a96fd5817b941dc86669278c1a17db10ed4e

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.30.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.1.1

v0.1.2

v0.1.3

v0.1.4

v0.1.5

v0.1.6

v0.1.7

v0.1.8

v0.10.0

v0.10.1

v0.10.2

v0.10.3

v0.10.4

v0.10.5

v0.10.6

v0.11.0

v0.11.1

v0.11.2

v0.11.3

v0.11.4

v0.12.0

v0.12.1

v0.12.2

v0.12.3

v0.12.4

v0.15.0

v0.15.1

v0.15.2

v0.15.3

v0.16.0

v0.16.1

v0.16.2

v0.16.3

v0.17.0

v0.17.1

v0.18.0

v0.18.1

v0.18.2

v0.18.3

v0.18.4

v0.19.0

v0.19.1

v0.19.2

v0.2.0

v0.2.1

v0.20.0

v0.20.1

v0.20.2

v0.20.3

v0.20.4

v0.20.5

v0.21.0

v0.22.0

v0.22.1

v0.22.2

v0.23.0

v0.24.0

v0.24.1

v0.25.0

v0.26.0

v0.27.0

v0.27.1

v0.28.0

v0.29.0

v0.29.1

v0.3.0

v0.3.1

v0.4.0

v0.5.0

v0.6.0

v0.7.0

v0.8.0

v0.8.1

v0.8.2

v0.8.3

v0.8.4

v0.8.5

v0.8.6

v0.8.7

v0.8.8

v0.8.9

v0.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86439.json"