knowns CVE-2026-88938

Exploitation requires an established AI agent session with access to the knowns MCP server instance (CVSS PR:L - low privilege). The attacker must control or inject into the agent's tool-call flow to supply a crafted path argument to code.find; realistic delivery mechanisms include: (1) directly controlling the agent session (insider or compromised orchestration), or (2) prompt injection via attacker-controlled content (documents, web pages, repository files) that the agent reads and acts upon. The vulnerability is present in all default deployments of knowns through 0.33.0 where the code.find tool is enabled - no special non-default configuration is required to be vulnerable. Exploitation is strictly limited to file reads (confidentiality); there is no write or code-execution primitive within this flaw alone. The attack is constrained to hosts and containers where the knowns process has filesystem read access.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) accurately reflects a network-reachable read-only path traversal gated behind low-privilege access - consistent with an authenticated AI agent session. Confidentiality impact is high because the entire host filesystem is potentially readable, including credential stores, private keys, and application secrets; integrity and availability are unaffected. No EPSS data was provided in the source intelligence, and the vulnerability is absent from CISA KEV, indicating no confirmed mass exploitation. However, the exploit technique requires only a crafted string within a normal MCP tool call, meaning even a mid-sized municipal IT team in malbork operating AI coding pipelines backed by knowns should treat this as urgent patching work if their agent workflows process any untrusted external input - prompt injection is a realistic delivery mechanism. The key limiting factor is PR:L: an attacker must already control or inject into an active AI agent session, which constrains the realistic attacker population to insiders, compromised orchestration layers, or adversarial document content fed to the agent.

An attacker who can inject adversarial content into documents processed by an AI agent session (prompt injection) crafts an instruction causing the agent to call code.find with path set to /root/.ssh/id_rsa or ../../../../etc/shadow. The knowns MCP server resolves the path without restriction and returns the file contents to the agent session, where the attacker can exfiltrate them. No public exploit code has been identified, but the technique requires only a crafted string within a standard MCP tool invocation.