CVE-2026-86540: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in knowns-dev knowns

The vulnerability exists due to missing validation of the 'binary' field in the LSP language settings within the project configuration file. The 'ProjectSettings.Validate()' function does not validate or restrict this field, allowing absolute paths and arbitrary executables. The LSP detection code blindly executes the specified binary during a version check and again when spawning the LSP server process. This leads to arbitrary code execution when a malicious repository containing a crafted '.knowns/config.json' is opened. The attack can be chained with a config overwrite vulnerability to achieve unauthenticated remote code execution.

An attacker who can plant or overwrite the '.knowns/config.json' file in a repository can cause the victim's Knowns client to execute arbitrary code on their system twice per session. This can lead to full remote code execution without authentication when combined with the config overwrite vulnerability. The impact is critical as it allows execution of attacker-controlled binaries with the privileges of the user running the Knowns client.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening untrusted repositories with Knowns clients and monitor for updates from the vendor. Do not rely on the current configuration validation as it does not prevent this attack.