Knowns
Monthly
Privilege escalation in knowns through 0.33.0 permits authenticated read-only agent sessions to bypass authorization controls entirely by invoking the project.set action, which is unconditionally exempted from the permission guard in the internal permissions subsystem. An attacker with any level of agent access can repoint the server to an arbitrary project directory, converting read-only access into write-capable access over the newly targeted directory. No public exploit code and no active exploitation are confirmed at time of analysis; the vulnerability is reported by VulnCheck referencing the upstream GitHub security advisory.
Path traversal in knowns through version 0.33.0 allows authenticated AI agent sessions to read arbitrary files anywhere on the host filesystem by supplying absolute paths or relative traversal sequences to the `code.find` MCP tool's path argument. The vulnerability exists because the handler in `internal/mcp/handlers/code.go` performs no canonicalization or boundary enforcement before passing the caller-supplied path to the underlying OS, bypassing the intended project-root confinement entirely. No public exploit code or CISA KEV listing exists at time of analysis, though the exploit primitive is trivially simple given the CWE-22 root cause.
Path traversal in the knowns code generation template engine (versions through 0.33.0) allows unauthenticated remote attackers to read and write arbitrary files outside the project root when a victim developer processes a malicious template. The flaw in template_engine.go (lines 318-344 and 625-636) permits directory-traversal sequences in template destination paths, enabling attackers to overwrite shell initialization files (e.g., ~/.bashrc, ~/.profile) for persistent code execution or exfiltrate credential files from the developer's host. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, but the full read/write impact on a developer workstation represents significant supply-chain risk.
External control of a filesystem path in Knowns (knowns-dev/knowns) before 0.31.0 lets remote attackers escape the project root by supplying an arbitrary path in the x-opencode-directory header of the /api/opencode proxy endpoint. Because the header is not validated before it becomes the agent's working directory, file operations can be redirected anywhere on the host, which VulnCheck and the vendor advisory characterize as achieving remote code execution (RCE tag). A vendor patch exists in 0.31.0; no public exploit is identified at time of analysis and this is not in CISA KEV.
Path traversal in the knowns npm documentation tool (versions ≤ 0.29.1) enables remote unauthenticated attackers to read, create, overwrite, or delete arbitrary files with a .md extension anywhere on the host filesystem, and to create arbitrary directories via os.MkdirAll. The Document API's sanitization function cleanDocPath() strips slashes and .md suffixes but leaves ../ sequences intact, allowing filepath.Join() to resolve paths outside the intended documents directory. In the default deployment - where the Management API binds to all interfaces without authentication - this is directly exploitable with a single crafted HTTP request, and the arbitrary-write primitive may be chained toward code execution. No confirmed active exploitation or public exploit code identified at time of analysis.
Authorization bypass in knowns before v0.30.0 allows low-privileged users holding read-restricted sessions to escalate privileges by exploiting the permission guard's misclassification of code mutation operations as read-only. Specifically, the `code.replace`, `code.rename`, `code.insert`, and `code.delete` MCP handlers failed to enforce write-access checks, enabling a low-privilege session to overwrite `.knowns/` permission configuration files and elevate to administrative access on subsequent calls. No public exploit has been identified at the time of analysis; a vendor-confirmed patch is available as v0.30.0.
Missing authentication in Knowns (knowns-dev/knowns) before 0.30.0 exposes the management API on all network interfaces (0.0.0.0) by default with no password set on fresh installs, letting anyone with network reachability drive the server. Attackers can call the unauthenticated /api/tunnel/start endpoint to spin up a public tunnel that republishes the entire management API at an internet-reachable address, escalating a LAN-only exposure into full public exposure. Reported by VulnCheck and fixed in v0.30.0; publicly available exploit code exists in the sense that the vulnerable endpoints and fix are documented, but no active exploitation is confirmed (not in CISA KEV).
Path traversal in knowns before v0.30.0 permits unauthenticated remote attackers to write files outside the designated imports directory by embedding directory traversal sequences in the import name parameter of the import routes API. Any file writable by the server process can be overwritten, making this a potential remote code execution primitive if configuration files, scripts, or other executable content reside within the process's write reach. No public exploit has been identified at time of analysis, but the patch commit and security advisory are publicly accessible on GitHub, lowering the barrier to reproduction.
Path traversal in the knowns MCP server's handleCodeReplace() function allows unauthenticated network attackers to overwrite arbitrary files outside the project root, including shell startup scripts (~/.bashrc, ~/.zshrc) and SSH configuration files (~/.ssh/authorized_keys). All knowns releases before v0.30.0 are affected; the root cause is the absence of path sanitization - the original code unconditionally joined caller-supplied paths onto the project root without verifying the resolved path remained within that boundary. No active exploitation confirmed in CISA KEV; no public exploit identified at time of analysis, though the GitHub security advisory and VulnCheck report provide sufficient technical detail for exploit construction.
Arbitrary binary execution in knowns before 0.30.0 is triggered when a developer opens a repository containing a crafted .knowns/config.json with a malicious settings.lsp.languages binary value. The LSP subsystem passes the attacker-controlled binary path directly to OS execution routines without any allowlist check, invoking the path twice under the victim's user account with no verification step. No public exploit is identified at time of analysis, though the GitHub security advisory GHSA-mc52-mwq4-vfx3 and the patch commit d3989829 provide full technical detail on both vulnerable code paths.
Path traversal in the knowns template-preview API (versions before 0.30.0) allows unauthenticated remote attackers to read arbitrary server-side files by injecting directory traversal sequences into the `templateFile` parameter of `POST /api/templates/preview`, with file contents returned directly in the JSON response. Sensitive targets include credential files, database configuration, and API keys accessible to the knowns process user. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept exploit is identified in available data, though the attack class is trivially executable with any HTTP client against an exposed instance.
Path traversal in knowns (a Go-based MCP-integrated knowledge management server) before version 0.30.0 allows authenticated remote attackers to read, create, overwrite, and delete arbitrary Markdown files accessible to the server process by supplying directory traversal sequences in MCP tool arguments. The flaw is rooted in the absence of any path containment validation in the storage layer (doc_store.go and memory_store.go), meaning MCP-issued file paths were passed directly to filesystem operations without sanitization. No public exploit is identified at time of analysis, though the fix commit, patch diff, and security advisory are all publicly available.
Directory traversal in knowns through 0.33.0 exposes arbitrary host filesystem paths to unauthenticated remote attackers via the workspace browse endpoint's unsanitized `path` query parameter. Attackers can walk the directory tree to map project directories, configuration file locations, and other filesystem structures without any credentials or special privileges. No public exploit has been identified at time of analysis, and impact is bounded to directory enumeration - file content cannot be read through this vector alone.
Server-side request forgery in Knowns ≤0.33.0 enables unauthenticated remote attackers to make the server issue outbound HTTP requests to arbitrary caller-supplied destinations via the POST /api/embedding-models/test endpoint. The application leaks network reachability information through transport-layer error messages, allowing attackers to enumerate internal hosts, cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), and adjacent services. No public exploit or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score is 6.9 (Medium), reflecting real but bounded impact.
Privilege escalation in knowns through 0.33.0 permits authenticated read-only agent sessions to bypass authorization controls entirely by invoking the project.set action, which is unconditionally exempted from the permission guard in the internal permissions subsystem. An attacker with any level of agent access can repoint the server to an arbitrary project directory, converting read-only access into write-capable access over the newly targeted directory. No public exploit code and no active exploitation are confirmed at time of analysis; the vulnerability is reported by VulnCheck referencing the upstream GitHub security advisory.
Path traversal in knowns through version 0.33.0 allows authenticated AI agent sessions to read arbitrary files anywhere on the host filesystem by supplying absolute paths or relative traversal sequences to the `code.find` MCP tool's path argument. The vulnerability exists because the handler in `internal/mcp/handlers/code.go` performs no canonicalization or boundary enforcement before passing the caller-supplied path to the underlying OS, bypassing the intended project-root confinement entirely. No public exploit code or CISA KEV listing exists at time of analysis, though the exploit primitive is trivially simple given the CWE-22 root cause.
Path traversal in the knowns code generation template engine (versions through 0.33.0) allows unauthenticated remote attackers to read and write arbitrary files outside the project root when a victim developer processes a malicious template. The flaw in template_engine.go (lines 318-344 and 625-636) permits directory-traversal sequences in template destination paths, enabling attackers to overwrite shell initialization files (e.g., ~/.bashrc, ~/.profile) for persistent code execution or exfiltrate credential files from the developer's host. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, but the full read/write impact on a developer workstation represents significant supply-chain risk.
External control of a filesystem path in Knowns (knowns-dev/knowns) before 0.31.0 lets remote attackers escape the project root by supplying an arbitrary path in the x-opencode-directory header of the /api/opencode proxy endpoint. Because the header is not validated before it becomes the agent's working directory, file operations can be redirected anywhere on the host, which VulnCheck and the vendor advisory characterize as achieving remote code execution (RCE tag). A vendor patch exists in 0.31.0; no public exploit is identified at time of analysis and this is not in CISA KEV.
Path traversal in the knowns npm documentation tool (versions ≤ 0.29.1) enables remote unauthenticated attackers to read, create, overwrite, or delete arbitrary files with a .md extension anywhere on the host filesystem, and to create arbitrary directories via os.MkdirAll. The Document API's sanitization function cleanDocPath() strips slashes and .md suffixes but leaves ../ sequences intact, allowing filepath.Join() to resolve paths outside the intended documents directory. In the default deployment - where the Management API binds to all interfaces without authentication - this is directly exploitable with a single crafted HTTP request, and the arbitrary-write primitive may be chained toward code execution. No confirmed active exploitation or public exploit code identified at time of analysis.
Authorization bypass in knowns before v0.30.0 allows low-privileged users holding read-restricted sessions to escalate privileges by exploiting the permission guard's misclassification of code mutation operations as read-only. Specifically, the `code.replace`, `code.rename`, `code.insert`, and `code.delete` MCP handlers failed to enforce write-access checks, enabling a low-privilege session to overwrite `.knowns/` permission configuration files and elevate to administrative access on subsequent calls. No public exploit has been identified at the time of analysis; a vendor-confirmed patch is available as v0.30.0.
Missing authentication in Knowns (knowns-dev/knowns) before 0.30.0 exposes the management API on all network interfaces (0.0.0.0) by default with no password set on fresh installs, letting anyone with network reachability drive the server. Attackers can call the unauthenticated /api/tunnel/start endpoint to spin up a public tunnel that republishes the entire management API at an internet-reachable address, escalating a LAN-only exposure into full public exposure. Reported by VulnCheck and fixed in v0.30.0; publicly available exploit code exists in the sense that the vulnerable endpoints and fix are documented, but no active exploitation is confirmed (not in CISA KEV).
Path traversal in knowns before v0.30.0 permits unauthenticated remote attackers to write files outside the designated imports directory by embedding directory traversal sequences in the import name parameter of the import routes API. Any file writable by the server process can be overwritten, making this a potential remote code execution primitive if configuration files, scripts, or other executable content reside within the process's write reach. No public exploit has been identified at time of analysis, but the patch commit and security advisory are publicly accessible on GitHub, lowering the barrier to reproduction.
Path traversal in the knowns MCP server's handleCodeReplace() function allows unauthenticated network attackers to overwrite arbitrary files outside the project root, including shell startup scripts (~/.bashrc, ~/.zshrc) and SSH configuration files (~/.ssh/authorized_keys). All knowns releases before v0.30.0 are affected; the root cause is the absence of path sanitization - the original code unconditionally joined caller-supplied paths onto the project root without verifying the resolved path remained within that boundary. No active exploitation confirmed in CISA KEV; no public exploit identified at time of analysis, though the GitHub security advisory and VulnCheck report provide sufficient technical detail for exploit construction.
Arbitrary binary execution in knowns before 0.30.0 is triggered when a developer opens a repository containing a crafted .knowns/config.json with a malicious settings.lsp.languages binary value. The LSP subsystem passes the attacker-controlled binary path directly to OS execution routines without any allowlist check, invoking the path twice under the victim's user account with no verification step. No public exploit is identified at time of analysis, though the GitHub security advisory GHSA-mc52-mwq4-vfx3 and the patch commit d3989829 provide full technical detail on both vulnerable code paths.
Path traversal in the knowns template-preview API (versions before 0.30.0) allows unauthenticated remote attackers to read arbitrary server-side files by injecting directory traversal sequences into the `templateFile` parameter of `POST /api/templates/preview`, with file contents returned directly in the JSON response. Sensitive targets include credential files, database configuration, and API keys accessible to the knowns process user. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept exploit is identified in available data, though the attack class is trivially executable with any HTTP client against an exposed instance.
Path traversal in knowns (a Go-based MCP-integrated knowledge management server) before version 0.30.0 allows authenticated remote attackers to read, create, overwrite, and delete arbitrary Markdown files accessible to the server process by supplying directory traversal sequences in MCP tool arguments. The flaw is rooted in the absence of any path containment validation in the storage layer (doc_store.go and memory_store.go), meaning MCP-issued file paths were passed directly to filesystem operations without sanitization. No public exploit is identified at time of analysis, though the fix commit, patch diff, and security advisory are all publicly available.
Directory traversal in knowns through 0.33.0 exposes arbitrary host filesystem paths to unauthenticated remote attackers via the workspace browse endpoint's unsanitized `path` query parameter. Attackers can walk the directory tree to map project directories, configuration file locations, and other filesystem structures without any credentials or special privileges. No public exploit has been identified at time of analysis, and impact is bounded to directory enumeration - file content cannot be read through this vector alone.
Server-side request forgery in Knowns ≤0.33.0 enables unauthenticated remote attackers to make the server issue outbound HTTP requests to arbitrary caller-supplied destinations via the POST /api/embedding-models/test endpoint. The application leaks network reachability information through transport-layer error messages, allowing attackers to enumerate internal hosts, cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), and adjacent services. No public exploit or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score is 6.9 (Medium), reflecting real but bounded impact.