EUVD-2026-75579
GHSA-w47m-jpv2-qfw5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network request with attacker-controlled header (PR:N/UI:N/AC:L) redirects agent file operations outside the project root, yielding full C/I/A impact via RCE.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system.
AnalysisAI
External control of a filesystem path in Knowns (knowns-dev/knowns) before 0.31.0 lets remote attackers escape the project root by supplying an arbitrary path in the x-opencode-directory header of the /api/opencode proxy endpoint. Because the header is not validated before it becomes the agent's working directory, file operations can be redirected anywhere on the host, which VulnCheck and the vendor advisory characterize as achieving remote code execution (RCE tag). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Knowns Web UI/proxy server (versions before 0.31.0) to be running and its /api/opencode endpoint reachable by the attacker; the attacker then supplies an arbitrary path in the x-opencode-directory request header, which the server uses as the agent working directory without validating it stays within the project root. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.3) rates this as network-reachable, unauthenticated, low-complexity with high impact on confidentiality, integrity and availability - consistent with the RCE tag if an attacker can reach the endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Knowns 0.31.0 or later, which contains the fix (Vendor-released patch: 0.31.0; commit 37db0561b37b48b8bd035a417d7f1da6258ae657 and release tag v0.31.0). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Knowns deployments and confirm current versions; review /api/opencode endpoint access logs for suspicious x-opencode-directory header values or path traversal patterns indicating reconnaissance or exploitation attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Missing authentication in Knowns (knowns-dev/knowns) before 0.30.0 exposes the management API on all network interfaces
Path traversal in the knowns npm documentation tool (versions ≤ 0.29.1) enables remote unauthenticated attackers to read
Path traversal in knowns before v0.30.0 permits unauthenticated remote attackers to write files outside the designated i
Path traversal in knowns (a Go-based MCP-integrated knowledge management server) before version 0.30.0 allows authentica
Path traversal in the knowns template-preview API (versions before 0.30.0) allows unauthenticated remote attackers to re
Privilege escalation in knowns through 0.33.0 permits authenticated read-only agent sessions to bypass authorization con
Path traversal in the knowns code generation template engine (versions through 0.33.0) allows unauthenticated remote att
Arbitrary binary execution in knowns before 0.30.0 is triggered when a developer opens a repository containing a crafted
Path traversal in the knowns MCP server's handleCodeReplace() function allows unauthenticated network attackers to overw
Authorization bypass in knowns before v0.30.0 allows low-privileged users holding read-restricted sessions to escalate p
Path traversal in knowns through version 0.33.0 allows authenticated AI agent sessions to read arbitrary files anywhere
Server-side request forgery in Knowns ≤0.33.0 enables unauthenticated remote attackers to make the server issue outbound
Same weakness CWE-73 – External Control of File Name or Path
View allShare
External POC / Exploit Code
Leaving vuln.today