CVE-2026-86541
published 2026-09-07CVE-2026-86541: knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files…
PriorityP350high8.3CVSS 3.1
AVNACLPRNUIRSUCLIHAH
EPSS
0.77%
53.8th percentile
knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious content to sensitive files like shell startup scripts or SSH configuration files.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| knowns-dev | knowns | < 0.30.0 | 0.30.0 |
CVSS provenance
nvdv3.18.3HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
nvdv4.07.2HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files outside the project root.
ghsa_unreviewed·2026-09-08
CVE-2026-86541 [HIGH] CWE-22 knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files outside the project root.
knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious content to sensitive files like shell startup scripts or SSH configuration files.
VulDB
knowns-dev knowns up to 0.29.x handleCodeReplace path traversal
vuldb·2026-09-08·CVSS 8.3
CVE-2026-86541 [HIGH] knowns-dev knowns up to 0.29.x handleCodeReplace path traversal
A vulnerability classified as critical was found in knowns-dev knowns up to 0.29.x. Affected by this issue is the function handleCodeReplace. Such manipulation leads to path traversal.
This vulnerability is documented as CVE-2026-86541. The attack can be executed remotely. There is not any exploit available.
Upgrading the affected component is advised.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/mcp/handlers/code.go#L588-L646https://github.com/knowns-dev/knowns/commit/a2c98fc5c313463576c9348beeec6a74ddd7333bhttps://github.com/knowns-dev/knowns/releases/tag/v0.30.0https://github.com/knowns-dev/knowns/security/advisories/GHSA-f539-xgc6-xw7qhttps://www.vulncheck.com/advisories/knowns-before-0.30.0-path-traversal-via-code-replace-mcp-action
2026-09-07
Published