Skip to content
OpenAdvisories

Package · npm

knowns

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.8
    CVE-2026-86540

    knowns before 0.30.0 Arbitrary Code Execution via LSP Binary

    knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configur…

    knowns-dev knowns knowns npm
  • High 8.8
    CVE-2026-86439

    knowns before 0.30.0 Path Traversal via MCP doc and memory tools

    knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences t…

    knowns-dev knowns knowns npm