Duplicate Advisory: knowns vulnerable to command injection

knowns versions prior to 0.30.0 do not properly validate the settings.lsp.languages binary field in project configuration files, enabling attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a user opens a repository containing this malicious configuration, the unvalidated binary path is executed twice under the user's account without verification. This vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The CVSS 3.1 score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. A patch is available in version 0.30.0.

Successful exploitation allows an attacker to execute arbitrary binaries on the victim's system with the privileges of the user opening the repository. This can lead to full compromise of the user's environment, including confidentiality, integrity, and availability impacts. The attack requires the user to open a repository containing the malicious configuration file, and no privileges are required prior to exploitation.

A patch is available in knowns version 0.30.0 that properly validates the settings.lsp.languages binary field to prevent command injection. Users and administrators should upgrade to version 0.30.0 or later to remediate this vulnerability. No additional mitigations are specified or required beyond applying the official fix.