CVE-2026-86439: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in knowns-dev knowns

CVE-2026-86439 is a path traversal vulnerability affecting knowns versions before 0.30.0. The vulnerability occurs because the MCP tool arguments do not properly validate filesystem paths, allowing attackers to supply directory traversal sequences. This enables unauthorized file system access beyond the project directory, including reading, creating, overwriting, and deleting files accessible to the server process. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required beyond limited privileges, no user interaction, and high impacts on confidentiality, integrity, and availability.

An attacker with limited privileges can exploit this vulnerability remotely to access and manipulate files outside the intended project directory. This can lead to unauthorized disclosure, modification, or deletion of files accessible to the server process, potentially compromising the integrity and availability of data managed by the knowns application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the MCP tool and limit privileges of users who can invoke it to reduce the risk of exploitation.