CVE-2026-86540

EUVD-2026-72558
knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 4.08%
Common Weakness Enumeration
References
https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/lsp/detect.go#L128-L157
https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/models/config.go#L205-L216
https://github.com/knowns-dev/knowns/commit/d3989829fb5095666d23d005b2f78a082832a396
https://github.com/knowns-dev/knowns/releases/tag/v0.30.0
https://github.com/knowns-dev/knowns/security/advisories/GHSA-mc52-mwq4-vfx3
https://www.vulncheck.com/advisories/knowns-before-0.30.0-arbitrary-code-execution-via-lsp-binary