Knip
Monthly
Path traversal in the Knip developer CLI (Webpro-nl, versions up to and including 6.44.0) allows a crafted 'workspaces' value in a project's Knip configuration to escape the intended directory when the autofix writeFile routine in IssueFixer.ts is executed, overwriting or deleting files outside the project tree. The issue is rated 5.3 MEDIUM under CVSS 4.0 (CWE-22); exploitation is not passive, it requires a victim to run the autofix/IssueFixer path against a project whose configuration or repository content is attacker-influenced, making this a developer-workstation and supply-chain exposure rather than a service-facing remote flaw. No confirmed active exploitation (CISA KEV) is recorded, but a public PoC reference exists; it is not verified as working exploit code. The vendor was contacted about the disclosure and did not respond.
Path traversal in the Knip developer CLI (Webpro-nl, versions up to and including 6.44.0) allows a crafted 'workspaces' value in a project's Knip configuration to escape the intended directory when the autofix writeFile routine in IssueFixer.ts is executed, overwriting or deleting files outside the project tree. The issue is rated 5.3 MEDIUM under CVSS 4.0 (CWE-22); exploitation is not passive, it requires a victim to run the autofix/IssueFixer path against a project whose configuration or repository content is attacker-influenced, making this a developer-workstation and supply-chain exposure rather than a service-facing remote flaw. No confirmed active exploitation (CISA KEV) is recorded, but a public PoC reference exists; it is not verified as working exploit code. The vendor was contacted about the disclosure and did not respond.