CVE-2026-86540 is an OS command injection vulnerability in knowns versions prior to 0.30.0. The vulnerability arises because the application fails to validate the settings.lsp.languages binary field in project configuration files. An attacker can craft a malicious .knowns/config.json file containing a binary path that is executed twice when the repository is opened, allowing arbitrary code execution with the privileges of the user running knowns.

Successful exploitation allows an attacker to execute arbitrary binaries on the victim's system with the user's privileges, potentially leading to full compromise of the user's environment. The binary is executed twice, increasing the risk of malicious payload execution. There is no indication of required privileges or user interaction beyond opening the repository. The CVSS 4.0 score is 8.5 (high severity), reflecting the ease of exploitation and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening repositories containing untrusted or suspicious .knowns/config.json files. Implementing manual validation or sandboxing of configuration files before opening repositories may reduce risk.