Knowns EUVD-2026-75579

Exploitation requires the Knowns Web UI/proxy server (versions before 0.31.0) to be running and its /api/opencode endpoint reachable by the attacker; the attacker then supplies an arbitrary path in the x-opencode-directory request header, which the server uses as the agent working directory without validating it stays within the project root. No authentication or user interaction is required per the CVSS vector (PR:N/UI:N). The key limiting factor is reachability: Knowns' UI server is a developer tool commonly bound to localhost, so practical exploitation depends on the server being exposed on a routable network interface (or reached same-host via a malicious page/SSRF) rather than a hardened default remote service.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.3) rates this as network-reachable, unauthenticated, low-complexity with high impact on confidentiality, integrity and availability - consistent with the RCE tag if an attacker can reach the endpoint. The strongest caveat is reachability: Knowns' Web UI/proxy is a developer-facing local server typically bound to localhost, so 'remote' exploitation in practice depends on the server being exposed on a routable interface or reached via a same-host malicious page/SSRF; the vector's AV:N is defensible per the description ('remote attackers') but real-world exposure is often narrower than the raw score implies. EPSS is not provided, the CVE is not in CISA KEV, and no POC is published, so despite the high CVSS this currently reads as a real-but-not-yet-actively-exploited priority. The vulnerability was reported by VulnCheck and a vendor security advisory (GHSA-9h2q-r9fh-f98w) plus a patch commit corroborate it, raising confidence in the finding itself.

An attacker who can reach a Knowns Web UI/proxy server (directly, or via a malicious web page or SSRF that causes a request to the local server) sends a crafted request to /api/opencode with x-opencode-directory set to a path such as /etc or a traversal sequence outside the project root. The agent then performs file operations in that attacker-chosen location, enabling reading of sensitive files or writing/overwriting files that lead to code execution on the host. No POC is currently public, and the network-facing, low-complexity, unauthenticated CVSS profile means little attacker effort is required once the endpoint is reachable.