High severity8.3NVD Advisory· Published Sep 7, 2026· Updated Sep 10, 2026
CVE-2026-86541
CVE-2026-86541
Description
knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious content to sensitive files like shell startup scripts or SSH configuration files.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <0.30.0
Patches
Vulnerability mechanics
References
5- github.com/knowns-dev/knowns/blob/v0.29.1/internal/mcp/handlers/code.gonvd
- github.com/knowns-dev/knowns/commit/a2c98fc5c313463576c9348beeec6a74ddd7333bnvd
- github.com/knowns-dev/knowns/releases/tag/v0.30.0nvd
- github.com/knowns-dev/knowns/security/advisories/GHSA-f539-xgc6-xw7qnvd
- www.vulncheck.com/advisories/knowns-before-0.30.0-path-traversal-via-code-replace-mcp-actionnvd
News mentions
0No linked articles in our index yet.