Skip to content
OpenAdvisories

Vendor

knowns-dev

14 known vulnerabilities.

Products

knowns 14
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-88899 Public exploit

    knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header

    knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system.

    knowns-dev knowns
  • Critical 9.1
    CVE-2026-86542

    knowns before 0.30.0 Path Traversal via Import Name

    knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overw…

    knowns-dev knowns
  • Critical 9.8
    CVE-2026-86543

    knowns before 0.30.0 Unauthenticated Management API Exposure

    knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tun…

    knowns-dev knowns