CVE-2026-86541

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-86541
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86541.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-86541
Aliases
  • GHSA-f539-xgc6-xw7q
Published
2026-09-07T23:03:19Z
Modified
2026-09-10T03:30:47Z
Severity
  • 7.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
knowns before 0.30.0 Path Traversal via code.replace MCP action
Details

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious content to sensitive files like shell startup scripts or SSH configuration files.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86541.json"
}
References

Affected packages

Git / github.com/knowns-dev/knowns

Affected ranges

Type
GIT
Repo
https://github.com/knowns-dev/knowns
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cead30b2c3a34f66c0c40cb692ed51e588e63bd7
Fixed
a2c98fc5c313463576c9348beeec6a74ddd7333b
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.30.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.10.0
v0.10.1
v0.10.2
v0.10.3
v0.10.4
v0.10.5
v0.10.6
v0.11.0
v0.11.1
v0.11.2
v0.11.3
v0.11.4
v0.12.0
v0.12.1
v0.12.2
v0.12.3
v0.12.4
v0.15.0
v0.15.1
v0.15.2
v0.15.3
v0.16.0
v0.16.1
v0.16.2
v0.16.3
v0.17.0
v0.17.1
v0.18.0
v0.18.1
v0.18.2
v0.18.3
v0.18.4
v0.19.0
v0.19.1
v0.19.2
v0.2.0
v0.2.1
v0.20.0
v0.20.1
v0.20.2
v0.20.3
v0.20.4
v0.20.5
v0.21.0
v0.22.0
v0.22.1
v0.22.2
v0.23.0
v0.24.0
v0.24.1
v0.25.0
v0.26.0
v0.27.0
v0.27.1
v0.28.0
v0.29.0
v0.29.1
v0.3.0
v0.3.1
v0.4.0
v0.5.0
v0.6.0
v0.7.0
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.8.7
v0.8.8
v0.8.9
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86541.json"