EUVD-2026-72562
GHSA-q52j-357p-5pv8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable MCP server, no special conditions, low-privilege session required; integrity and availability both high due to permission registry overwrite enabling full privilege escalation.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.
AnalysisAI
Authorization bypass in knowns before v0.30.0 allows low-privileged users holding read-restricted sessions to escalate privileges by exploiting the permission guard's misclassification of code mutation operations as read-only. Specifically, the code.replace, code.rename, code.insert, and code.delete MCP handlers failed to enforce write-access checks, enabling a low-privilege session to overwrite .knowns/ permission configuration files and elevate to administrative access on subsequent calls. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid knowns session credential with at minimum read-restricted access (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.2 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H) accurately reflects the core risk: network-exploitable, no special conditions, requiring only a low-privilege session, with high integrity and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to knowns v0.30.0 or later, which resolves the authorization bypass by introducing `ensureCodeMutationPath()` validation across all code mutation handlers and adding symlink-aware safe path resolution via the `safepath` package. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all knowns deployments and identify instances running versions prior to 0.30.0, prioritizing production systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Missing authentication in Knowns (knowns-dev/knowns) before 0.30.0 exposes the management API on all network interfaces
External control of a filesystem path in Knowns (knowns-dev/knowns) before 0.31.0 lets remote attackers escape the proje
Path traversal in the knowns npm documentation tool (versions ≤ 0.29.1) enables remote unauthenticated attackers to read
Path traversal in knowns before v0.30.0 permits unauthenticated remote attackers to write files outside the designated i
Path traversal in knowns (a Go-based MCP-integrated knowledge management server) before version 0.30.0 allows authentica
Path traversal in the knowns template-preview API (versions before 0.30.0) allows unauthenticated remote attackers to re
Privilege escalation in knowns through 0.33.0 permits authenticated read-only agent sessions to bypass authorization con
Path traversal in the knowns code generation template engine (versions through 0.33.0) allows unauthenticated remote att
Arbitrary binary execution in knowns before 0.30.0 is triggered when a developer opens a repository containing a crafted
Path traversal in the knowns MCP server's handleCodeReplace() function allows unauthenticated network attackers to overw
Path traversal in knowns through version 0.33.0 allows authenticated AI agent sessions to read arbitrary files anywhere
Server-side request forgery in Knowns ≤0.33.0 enables unauthenticated remote attackers to make the server issue outbound
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today