CVE-2026-86540
CVE-2026-86540 · knowns before 0.30.0 Arbitrary Code Execution via LSP Binary
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.
CVSS 8.5 · Alta · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
Fuentes originales
- https://github.com/knowns-dev/knowns/security/advisories/GHSA-mc52-mwq4-vfx3
- https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/lsp/detect.go#L128-L157
- https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/models/config.go#L205-L216
- https://github.com/knowns-dev/knowns/commit/d3989829fb5095666d23d005b2f78a082832a396
- https://github.com/knowns-dev/knowns/releases/tag/v0.30.0
- https://www.vulncheck.com/advisories/knowns-before-0.30.0-arbitrary-code-execution-via-lsp-binary
- https://nvd.nist.gov/vuln/detail/CVE-2026-86540