Description

knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the server process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-07T23:16:54.020Z",
  "pubdate": "2026-09-07T23:16:54.020Z",
  "executiveSummary": "The knowns package prior to version 0.30.0 is susceptible to an arbitrary file write vulnerability resulting from improper input validation within its import routing functionality.\nThis vulnerability is classified as a Path Traversal issue, allowing remote, unauthenticated attackers to escape the intended directory boundaries during file operations.\nBy manipulating the name parameter in import requests, an attacker can overwrite arbitrary files accessible to the system process running the application.\nThe risk implication is critical, as successful exploitation enables remote code execution, configuration tampering, or data destruction, depending on the files targeted and the permissions of the underlying server process.\nNo authentication is required to trigger this vulnerability, making it highly accessible for exploitation over the network.\nOrganizations using versions of knowns earlier than 0.30.0 are advised to treat this as a high-priority security concern.",
  "technicalDetails": "The vulnerability exists within the import routes of the knowns package, where the application fails to properly sanitize or validate the name parameter before utilizing it in file system operations.\nSpecifically, the application logic does not neutralize directory traversal sequences (e.g., ../) provided by an attacker, effectively bypassing the intended sandbox or restricted directory structure (the imports directory).\nThe attack flow begins when an unauthenticated attacker sends a crafted request containing a malicious payload in the name parameter. This payload incorporates directory traversal sequences that allow the attacker to navigate outside the intended working directory.\nUpon receiving this input, the application performs a file write operation using the unsanitized path. Because the application logic fails to restrict this path to the intended directory, the underlying file system API resolves the path relative to the root or the application's working directory, depending on the operating system and execution context.\nAs a result, the server process, acting with its assigned operating system permissions, overwrites or creates files at arbitrary locations on the host system that are writable by the server's user account.\nThis behavior facilitates several critical attack vectors, including overwriting sensitive configuration files, modifying application source code to insert backdoors, or replacing binary executables to achieve persistent remote code execution.\nThe vulnerability is present in all versions of knowns prior to 0.30.0.\nThe impact is significant, as the exploitation requirement is minimal—only network connectivity to the application is needed, and no prior authentication or administrative privileges are required to initiate the malicious request."
}