GHSA-6ph4-r249-58p2

Source

https://github.com/advisories/GHSA-6ph4-r249-58p2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6ph4-r249-58p2/GHSA-6ph4-r249-58p2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6ph4-r249-58p2

Withdrawn

2026-10-06T18:57:55Z

Published

2026-09-08T00:30:22Z

Modified

2026-10-06T19:00:43Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

Duplicate Advisory: knowns vulnerable to command injection

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-mc52-mwq4-vfx3. This link is maintained to preserve external references.

Original Description

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.

Database specific

{
    "cwe_ids":  [
        "CWE-78"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-06T18:57:55Z",
    "nvd_published_at":  "2026-09-07T23:16:53Z",
    "severity":  "HIGH"
}

References

Affected packages

npm / knowns

Package

Name: knowns; View open source insights on deps.dev
Purl: pkg:npm/knowns

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.30.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6ph4-r249-58p2/GHSA-6ph4-r249-58p2.json"