knowns CVE-2026-88937

The victim must be running knowns version 0.33.0 or earlier and must invoke the code generation engine against an attacker-controlled template - this is the sole triggering condition (UI:A in CVSS 4.0). No authentication, special configuration, or non-default deployment mode is required on the attacker's side; the traversal path is embedded in the template file itself. Exploitation is limited by the need for developer interaction: the victim must actively fetch and run a malicious template. The impact is bounded by the filesystem permissions of the user executing knowns - root-owned files are not writable unless the tool is run as root, which is not a typical developer workflow. No specific OS or platform restriction is documented.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A - score 8.6) accurately captures the attack surface: no privileges or special configuration needed, but user interaction is required (a developer must invoke the code generator with an attacker-supplied template). The high VC:H/VI:H/VA:H scores are credible given that arbitrary file write to a developer workstation trivially achieves persistent RCE via shell profile manipulation. EPSS data is not provided in source intelligence. No CISA KEV listing and no explicit POC code, suggesting no confirmed in-the-wild mass exploitation yet. However, the developer toolchain targeting vector (supply-chain / malicious template repository attack) is realistic and has been used in analogous campaigns against npm, PyPI, and similar ecosystems. The VulnCheck report and two GitHub Security Advisories raise confidence that the issue is genuine and independently confirmed. The primary limiting factor is UI:A - mass exploitation requires victims to actively process attacker-controlled templates, reducing automated exploitation potential.

A threat actor publishes a malicious knowns template to a public template registry or contributes it to a shared project repository. When a developer runs knowns to generate code using this template, the template engine writes a payload to ~/.bashrc (e.g., a reverse shell one-liner) due to the unvalidated traversal path embedded in the template metadata. On the developer's next shell login, the payload executes, establishing persistent access to the workstation and any credentials, tokens, or SSH keys stored there.