CVE-2026-86540 in knowns
Summary
by MITRE • 09/08/2026
knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in versions of the knowns software prior to 0.30.0 represents a critical security flaw rooted in insufficient input validation within the application's project configuration handling mechanism. Specifically, the settings.lsp.languages binary field is not subjected to rigorous integrity checks or path normalization before execution. This oversight allows an attacker who can influence the content of the .knowns/config.json file to inject arbitrary commands that will be executed by the host system when a repository containing this malicious configuration is opened. The core technical failure lies in the application's assumption that configuration files are trusted sources, neglecting the reality that such files may originate from untrusted or compromised repositories shared within collaborative development environments.
From an operational perspective, this vulnerability enables remote code execution under the context of the user launching the application. When a developer opens a repository containing the crafted config.json file, the software parses the configuration and immediately attempts to execute the binary path specified in the settings.lsp.languages field. Crucially, this execution occurs twice without any verification step to confirm that the target is indeed a legitimate language server or expected utility. This double execution amplifies the potential impact, as it may trigger multiple instances of malicious payloads, leading to resource exhaustion, data exfiltration, or further lateral movement within the user's environment depending on the nature of the injected binary.
This flaw aligns with CWE-94 Improper Control of Generation of Code (Code Injection), specifically where untrusted input is used to direct the execution of system commands. It also maps closely to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, as it involves the abuse of legitimate system tools or binaries for malicious purposes through configuration manipulation. The attack vector typically requires social engineering or repository compromise to introduce the malicious config file, but once introduced, exploitation is automatic upon opening the project, requiring no further user interaction beyond standard workflow activities like loading a workspace.
Mitigation strategies must prioritize immediate updates to version 0.30.0 or later, where this validation logic has been addressed. In environments where upgrading is not immediately feasible, administrators should enforce strict policies regarding the sourcing of configuration files and consider implementing application whitelisting solutions that restrict which binaries can be executed by the knowns process. Additionally, developers should treat all project-level configuration files as untrusted input until proven otherwise, applying allow-listing principles to validate binary paths against a predefined set of approved language servers or utilities before execution is permitted.