CVE-2026-86541

CVE-2026-86541 is a path traversal vulnerability (CWE-22) in the handleCodeReplace() function of the knowns software, affecting all versions before 0.30.0. An attacker can trigger it over the network by supplying an absolute path or a relative path containing directory traversal sequences (e.g., ../), causing the function to write attacker-controlled content to files outside the project root; the CVSS 4.0 scoring indicates no privileges are required but some user interaction is involved. By overwriting sensitive files such as shell startup scripts or SSH configuration files, the attacker gains high-impact, persistent modification of files on the host, which can lead to code execution or unauthorized access when those files are next used. Anyone running an affected version of knowns is exposed, with the greatest risk on systems where the tool processes attacker-controlled path inputs. There is currently no known public proof-of-concept, no evidence of in-the-wild exploitation, the flaw is not in CISA KEV, and EPSS assigns a modest 0.5% probability of exploitation within the next 30 days.

What to do: Upgrade to knowns 0.30.0 or later, which fixes the traversal in handleCodeReplace(). Until upgraded, avoid running affected versions with untrusted path inputs and validate that any replacement paths resolve within the project root. Teams that ran vulnerable versions should review shell startup scripts (e.g., ~/.bashrc, ~/.profile) and SSH configuration files (e.g., ~/.ssh/config, ~/.ssh/authorized_keys) for unexpected or unauthorized changes.