Threats Tagged 'ghsa-6ph4-r249-58p2'

CVE-2026-86540 is a critical arbitrary code execution vulnerability in the Knowns Language Server Protocol (LSP) detection and startup pipeline. It arises because the project-level configuration file (.knowns/config.json) allows an attacker to specify an arbitrary binary path in the 'settings.lsp.languages.<lang>.binary' field without validation. This untrusted binary is executed twice per session: once during a health check and again when the LSP server starts. When combined with a separate config overwrite vulnerability, this flaw enables unauthenticated remote code execution.

A command injection vulnerability exists in knowns versions before 0.30.0 due to improper validation of the settings.lsp.languages binary field in project configuration files. This allows attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. The malicious binary path is executed twice under the user's account when a repository with the crafted configuration is opened. The vulnerability has a high severity with a CVSS score of 7.8 and has been patched in version 0.30.0.