CVE-2026-88938

knowns through version 0.33.0 fails to confine the path argument of its code.find MCP tool to the project root, a path traversal flaw tracked as CWE-22. An AI agent session, or an attacker who can influence that session's tool calls, can supply an absolute path or relative traversal sequences to the path argument and retrieve the full contents of files anywhere on the host running the tool. The impact is confidentiality-only: the CVSS 4.0 vector (VC:H with no integrity or availability impact) scores 7.1 High, with a network attack vector, low privileges required, and no user interaction needed. Anyone running knowns up to and including 0.33.0 with the code.find MCP tool available to agent sessions is affected, particularly deployments where the MCP server has broad filesystem access. No public proof-of-concept is known and the issue is not in CISA KEV, so no exploitation is confirmed at this time.

What to do: Upgrade knowns to a release newer than 0.33.0 once a patched version is published, as the advisory does not name a specific fixed version. Until then, restrict or disable the code.find MCP tool, run the MCP server as a low-privilege user with filesystem access limited to project directories, and avoid letting agent sessions pass absolute paths or traversal sequences. Also review hosts for sensitive files (configuration files, credentials) reachable outside the project root and check whether any agent sessions have read paths outside it.