CVE-2026-86439

knowns versions before 0.30.0 fail to validate filesystem paths supplied as MCP tool arguments, a classic path traversal flaw (CWE-22) rated 8.7 (High) under CVSS 4.0. An attacker with the privileges needed to invoke the MCP tools can pass path arguments containing directory traversal sequences (e.g., "../") to escape the project directory. This lets the attacker read, create, overwrite and delete arbitrary files accessible to the server process, including Markdown files stored outside the intended project directory. Any deployment of knowns running a version below 0.30.0 is affected. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.8% probability of exploitation within 30 days.

What to do: Upgrade to knowns 0.30.0 or later, which validates filesystem paths in MCP tool arguments. Until upgraded, restrict which users or agents can invoke the MCP file tools and limit the server process's filesystem permissions to the intended project directory. Review accessible directories for unexpected file creation, modification or deletion, particularly Markdown files outside the project path.