EUVD-2026-72559
GHSA-g6q2-h5cf-8q26
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible MCP server, no auth required, passive session interaction needed; integrity and availability high from arbitrary file writes to sensitive dotfiles.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious content to sensitive files like shell startup scripts or SSH configuration files.
AnalysisAI
Path traversal in the knowns MCP server's handleCodeReplace() function allows unauthenticated network attackers to overwrite arbitrary files outside the project root, including shell startup scripts (~/.bashrc, ~/.zshrc) and SSH configuration files (~/.ssh/authorized_keys). All knowns releases before v0.30.0 are affected; the root cause is the absence of path sanitization - the original code unconditionally joined caller-supplied paths onto the project root without verifying the resolved path remained within that boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker can send an MCP tool call (specifically an action targeting code replacement, insertion, deletion, or rename) to the knowns MCP server process. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) scores 7.2 and captures the key risk profile accurately: network-reachable, low complexity, no authentication, with passive user interaction reflecting that a developer must be running the MCP server session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to knowns v0.30.0 or later; this is the vendor-released patch that introduces path containment validation via the safepath package and the ensureCodeMutationPath() guard function (patch commit a2c98fc5c313463576c9348beeec6a74ddd7333b, release tag v0.30.0). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running knowns MCP server versions before v0.30.0, particularly those accessible from untrusted networks, and isolate or restrict access as needed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Missing authentication in Knowns (knowns-dev/knowns) before 0.30.0 exposes the management API on all network interfaces
External control of a filesystem path in Knowns (knowns-dev/knowns) before 0.31.0 lets remote attackers escape the proje
Path traversal in the knowns npm documentation tool (versions ≤ 0.29.1) enables remote unauthenticated attackers to read
Path traversal in knowns before v0.30.0 permits unauthenticated remote attackers to write files outside the designated i
Path traversal in knowns (a Go-based MCP-integrated knowledge management server) before version 0.30.0 allows authentica
Path traversal in the knowns template-preview API (versions before 0.30.0) allows unauthenticated remote attackers to re
Privilege escalation in knowns through 0.33.0 permits authenticated read-only agent sessions to bypass authorization con
Path traversal in the knowns code generation template engine (versions through 0.33.0) allows unauthenticated remote att
Arbitrary binary execution in knowns before 0.30.0 is triggered when a developer opens a repository containing a crafted
Authorization bypass in knowns before v0.30.0 allows low-privileged users holding read-restricted sessions to escalate p
Path traversal in knowns through version 0.33.0 allows authenticated AI agent sessions to read arbitrary files anywhere
Server-side request forgery in Knowns ≤0.33.0 enables unauthenticated remote attackers to make the server issue outbound
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today