EUVD-2026-75582
GHSA-qwj4-f78f-jj3j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no special conditions, requires valid low-privilege agent session (PR:L), no scope change beyond the affected server, high C/I from directory repoint, low A.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypass restrictions. Attackers can invoke project.set to repoint the server at another project directory and obtain write access capabilities.
AnalysisAI
Privilege escalation in knowns through 0.33.0 permits authenticated read-only agent sessions to bypass authorization controls entirely by invoking the project.set action, which is unconditionally exempted from the permission guard in the internal permissions subsystem. An attacker with any level of agent access can repoint the server to an arbitrary project directory, converting read-only access into write-capable access over the newly targeted directory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires possession of a valid read-only agent session credential for the knowns server - any agent-level access suffices. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L) scores 8.7, reflecting network-accessible exploitation with low attack complexity, no special requirements, but requiring at minimum a low-privilege agent session (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update knowns to the first version released after 0.33.0; the exact patched release version is not specified in the available input data and should be confirmed via the upstream advisory at https://github.com/knowns-dev/knowns/security/advisories/GHSA-h73x-698r-qrvg before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all systems running knowns versions ≤0.33.0, audit logs for project.set action invocations by read-only agents, and restrict agent access scope to minimal required directories if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Missing authentication in Knowns (knowns-dev/knowns) before 0.30.0 exposes the management API on all network interfaces
External control of a filesystem path in Knowns (knowns-dev/knowns) before 0.31.0 lets remote attackers escape the proje
Path traversal in the knowns npm documentation tool (versions ≤ 0.29.1) enables remote unauthenticated attackers to read
Path traversal in knowns before v0.30.0 permits unauthenticated remote attackers to write files outside the designated i
Path traversal in knowns (a Go-based MCP-integrated knowledge management server) before version 0.30.0 allows authentica
Path traversal in the knowns template-preview API (versions before 0.30.0) allows unauthenticated remote attackers to re
Path traversal in the knowns code generation template engine (versions through 0.33.0) allows unauthenticated remote att
Arbitrary binary execution in knowns before 0.30.0 is triggered when a developer opens a repository containing a crafted
Path traversal in the knowns MCP server's handleCodeReplace() function allows unauthenticated network attackers to overw
Authorization bypass in knowns before v0.30.0 allows low-privileged users holding read-restricted sessions to escalate p
Path traversal in knowns through version 0.33.0 allows authenticated AI agent sessions to read arbitrary files anywhere
Server-side request forgery in Knowns ≤0.33.0 enables unauthenticated remote attackers to make the server issue outbound
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today