knowns CVE-2026-86439

Exploitation requires authenticated low-privilege access to the knowns MCP tool interface (PR:L per the CVSS 4.0 vector) over the network. The MCP server must be running and reachable. No special non-default configuration is required - any deployment of knowns before v0.30.0 with the MCP interface enabled is vulnerable. Impact is bounded by the OS-level file permissions of the server process user: an attacker cannot read files the process cannot access. In AI-agent deployments, a prompt-injection attack against the LLM using knowns may reduce the effective privilege requirement by coercing the model into issuing malicious path arguments autonomously.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) is well-calibrated: network-accessible, low complexity, requiring only low privilege, with full C/I/A impact on the vulnerable system and no scope change. The PR:L requirement meaningfully limits automated exploitation - an attacker must first obtain MCP client credentials or session access. The MCP attack surface introduces an additional threat model unique to AI-integrated deployments: a prompt-injection attack against an LLM agent using knowns could cause the model to autonomously issue crafted path arguments, effectively reducing the privilege barrier in certain deployments. No CISA KEV listing and no confirmed standalone POC exist at time of analysis. Real-world risk is constrained by the product's niche footprint and the PR:L requirement, but organizations using knowns in LLM agent pipelines should treat this as higher priority due to the prompt-injection amplification scenario.

An attacker authenticated to the knowns MCP interface - or an LLM agent prompted to do so via prompt injection - submits a memory or document tool call with a path argument such as ../../.ssh/authorized_keys or ../../../etc/passwd. The server, performing no containment check, resolves the path relative to the project root, reads the target file, and returns its contents to the caller. An attacker with write access can similarly overwrite configuration or credential files to escalate privileges on the host.