CVE-2026-86439 describes an improper limitation of a pathname to a restricted directory vulnerability (path traversal) in knowns-dev's knowns software. Versions before 0.30.0 do not properly validate filesystem paths passed as arguments to the MCP tool, enabling attackers to supply directory traversal sequences. This allows unauthorized file operations outside the project directory, including reading, creating, overwriting, and deleting files accessible to the server process.

Exploitation of this vulnerability can result in unauthorized access and modification of files outside the intended directory scope. This can compromise data integrity and confidentiality by allowing attackers to read or alter arbitrary Markdown files or other files accessible to the server process. The CVSS 4.0 score of 8.7 (high severity) reflects the network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

No official patch or remediation level is currently documented. Users should monitor the vendor's advisories for updates and apply any forthcoming fixes promptly. Until a fix is available, restrict access to the MCP tool and limit exposure of the server process to untrusted users to reduce exploitation risk.