CVE-2026-120325 in Knip
Summary
by MITRE • 11/02/2026
A security vulnerability has been detected in Webpro-nl Knip up to 6.44.0. The impacted element is the function writeFile of the file packages/knip/src/IssueFixer.ts of the component Workspace Handler. Such manipulation of the argument workspaces leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified within Webpro-nl Knip versions up to 6.44.0 represents a critical path traversal flaw located specifically within the writeFile function of the IssueFixer.ts file, which is part of the Workspace Handler component. This architectural weakness arises from insufficient validation and sanitization of user-supplied input when handling workspace configurations. The core technical failure lies in the application's inability to properly normalize or restrict file paths before writing data, allowing an attacker to manipulate the workspaces argument to escape the intended directory structure. By injecting relative path sequences such as dot-dot-slash into the configuration parameters, a remote actor can direct the write operation to arbitrary locations on the host filesystem rather than within the designated project root. This lack of strict boundary enforcement is a classic example of improper input validation that compromises the integrity and confidentiality of the system environment.
From an operational perspective, this vulnerability poses severe risks including unauthorized file creation or modification, potential overwriting of critical configuration files, and in worst-case scenarios, remote code execution if writable directories contain executable scripts or interpreters are involved in subsequent processing steps. The ability to write arbitrary files remotely means that attackers could plant malicious web shells, modify source code to introduce backdoors, or disrupt service availability by corrupting essential project assets. Since the exploit has been publicly disclosed and is actively usable, systems running affected versions of Knip are immediately exposed to active exploitation attempts without requiring authentication if the tool is configured to process untrusted workspace inputs via automated pipelines or public repositories. The vendor's lack of response further exacerbates the risk by delaying official patches and forcing users to rely on community-driven mitigations or version upgrades as soon as they become available.
This vulnerability aligns with CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The attack vector is classified under MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter subcategories if the written files are executed, or more broadly within Initial Access techniques involving file manipulation for persistence or impact. To mitigate this risk immediately, organizations should restrict Knip execution to trusted inputs only, ensuring that workspace configurations originate from verified sources rather than untrusted repositories or user submissions in CI/CD pipelines. Implementing strict allowlists for directory paths and validating all input parameters against expected formats can prevent the injection of traversal sequences. Additionally, running Knip with minimal file system privileges limits the potential damage even if a write operation succeeds outside the intended scope. Upgrading to a patched version once released is essential, but until then, isolating the tool within containerized environments or using chroot jails can provide an additional layer of defense against filesystem manipulation attacks.