EUVD-2026-75581
GHSA-629c-j52g-h978
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible MCP server requires an active agent session (PR:L); pure read-only traversal yields high confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files anywhere on the host. Attackers can supply absolute paths or relative traversal sequences to the path argument and retrieve full file contents from outside the intended project directory.
AnalysisAI
Path traversal in knowns through version 0.33.0 allows authenticated AI agent sessions to read arbitrary files anywhere on the host filesystem by supplying absolute paths or relative traversal sequences to the code.find MCP tool's path argument. The vulnerability exists because the handler in internal/mcp/handlers/code.go performs no canonicalization or boundary enforcement before passing the caller-supplied path to the underlying OS, bypassing the intended project-root confinement entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an established AI agent session with access to the knowns MCP server instance (CVSS PR:L - low privilege). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) accurately reflects a network-reachable read-only path traversal gated behind low-privilege access - consistent with an authenticated AI agent session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade knowns to a version beyond 0.33.0 that includes path canonicalization and project-root boundary enforcement in the `code.find` handler; the exact patched release version should be confirmed via the GitHub security advisory at https://github.com/knowns-dev/knowns/security/advisories/GHSA-5cj9-fcqq-g2h7, as the available intelligence does not specify an exact fix version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all deployments of Knowns 0.33.0 and earlier and assess user access levels; implement network segmentation to restrict Knowns access to trusted internal networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Missing authentication in Knowns (knowns-dev/knowns) before 0.30.0 exposes the management API on all network interfaces
External control of a filesystem path in Knowns (knowns-dev/knowns) before 0.31.0 lets remote attackers escape the proje
Path traversal in the knowns npm documentation tool (versions ≤ 0.29.1) enables remote unauthenticated attackers to read
Path traversal in knowns before v0.30.0 permits unauthenticated remote attackers to write files outside the designated i
Path traversal in knowns (a Go-based MCP-integrated knowledge management server) before version 0.30.0 allows authentica
Path traversal in the knowns template-preview API (versions before 0.30.0) allows unauthenticated remote attackers to re
Privilege escalation in knowns through 0.33.0 permits authenticated read-only agent sessions to bypass authorization con
Path traversal in the knowns code generation template engine (versions through 0.33.0) allows unauthenticated remote att
Arbitrary binary execution in knowns before 0.30.0 is triggered when a developer opens a repository containing a crafted
Path traversal in the knowns MCP server's handleCodeReplace() function allows unauthenticated network attackers to overw
Authorization bypass in knowns before v0.30.0 allows low-privileged users holding read-restricted sessions to escalate p
Server-side request forgery in Knowns ≤0.33.0 enables unauthenticated remote attackers to make the server issue outbound
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today