CVE-2026-86540

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, launching whatever binary path a .knowns/config.json specifies without any verification. An attacker who can place a crafted .knowns/config.json in a repository — for example by getting a user to clone a malicious repo — triggers execution of an arbitrary binary, twice, when the victim opens that repository. This yields arbitrary code execution under the local user's account (CWE-78), consistent with the high local-attack CVSS 4.0 base score of 8.5 (no privileges required, user interaction required, high impacts). Any knowns user running a version below 0.30.0 who opens a repository from an untrusted or attacker-controlled source is affected. No public proof-of-concept, KEV listing, or known in-the-wild exploitation exists, and EPSS estimates only about a 0.1% probability of exploitation within 30 days.

What to do: Upgrade knowns to version 0.30.0 or later, which validates the settings.lsp.languages binary field. Until patched, inspect .knowns/config.json in any repository before opening it and avoid opening untrusted repositories, since the configured binary is executed without verification. If you recently opened a repository from an untrusted source, audit for unexpectedly launched processes under your user account.