Description

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-07T23:16:53.723Z",
  "pubdate": "2026-09-07T23:16:53.723Z",
  "executiveSummary": "The vulnerability in knowns versions prior to 0.30.0 consists of an insecure handling of external configuration files, specifically within the settings.lsp.languages binary field. This flaw allows for arbitrary code execution on the host machine.\nThe vulnerability type is classified as an Uncontrolled Search Path Element or Improper Input Validation, leading to unauthorized binary execution.\nThe impact of this vulnerability is critical, as an attacker can execute arbitrary code under the context of the user running the knowns application.\nAffected systems include all knowns installations prior to version 0.30.0.\nExploitation requires an attacker to convince a user to open a repository containing a maliciously crafted .knowns/config.json file. Once the repository is initialized or opened, the application executes the specified binary path without validation.\nThis poses significant risk, as it facilitates unauthorized remote code execution, potential data theft, or lateral movement within the user's environment by leveraging the trust placed in local configuration files.\nNo authentication or elevated privileges are required beyond the ability to provide a malicious repository to the target user.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper validation of the binary field within the settings.lsp.languages configuration object located inside the .knowns/config.json project configuration file. The application fails to sanitize or verify the integrity and origin of the file paths defined in this configuration.\nWhen a user opens a repository using knowns, the application parses the .knowns/config.json file to configure its environment. Because the binary field is treated as a trusted input, the application proceeds to execute the referenced file. This process occurs twice per opening event, resulting in multiple executions of the specified binary under the user's current operating system account privileges.\nThe attack flow begins when an attacker creates a malicious repository containing a modified .knowns/config.json file. In this file, the binary path in settings.lsp.languages is directed toward an arbitrary malicious executable, which could be an existing system binary or a payload bundled within the repository.\nWhen the victim opens the malicious directory in knowns, the application initiates the execution chain. Because there is no check to ensure the path corresponds to an expected or safe location, the operating system executes the user-specified payload immediately.\nThis vulnerability is particularly dangerous because the application does not enforce path sanitization, nor does it implement an allow-list for permissible binary locations. Consequently, any executable accessible to the user account—or included within the repository structure—can be triggered.\nThe post-exploitation impact is severe, as it enables the execution of arbitrary commands with the permissions of the local user. An attacker could establish persistence, exfiltrate sensitive files, or install further malware, effectively granting the attacker full control over the session initiated by the knowns application.\nThe vulnerability is present in all versions prior to 0.30.0 and does not require the attacker to have prior knowledge of the user's machine configuration, provided they can influence the contents of the opened repository."
}