{"id":"EUVD-2026-72558","enisaUuid":"6693d9e9-51d3-3e7f-9532-385e1e3493e7","description":"knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user\u0027s account without any verification.","datePublished":"Sep 7, 2026, 11:03:18 PM","dateUpdated":"Sep 24, 2026, 2:21:24 PM","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/knowns-dev/knowns/security/advisories/GHSA-mc52-mwq4-vfx3\nhttps://github.com/knowns-dev/knowns/blob/v0.29.1/internal/lsp/detect.go#L128-L157\nhttps://github.com/knowns-dev/knowns/blob/v0.29.1/internal/models/config.go#L205-L216\nhttps://github.com/knowns-dev/knowns/commit/d3989829fb5095666d23d005b2f78a082832a396\nhttps://github.com/knowns-dev/knowns/releases/tag/v0.30.0\nhttps://www.vulncheck.com/advisories/knowns-before-0.30.0-arbitrary-code-execution-via-lsp-binary\n","aliases":"CVE-2026-86540\nGHSA-6ph4-r249-58p2\nGHSA-mc52-mwq4-vfx3\n","assigner":"VulnCheck","epss":0.21,"enisaIdProduct":[{"id":"8cb2b293-5cbb-3235-be6d-9c59d687dcce","product":{"name":"knowns","vendor":{"name":"knowns-dev"}},"product_version":"0 \u003c0.30.0"}],"enisaIdVendor":[{"id":"a335bd74-5997-3bab-b160-d550e7d1738a","vendor":{"name":"knowns-dev"}}],"enisaIdVulnerability":[{"id":"07e55043-e849-3206-8e7f-39177e07ea23","vulnerability":{"id":"GHSA-6ph4-r249-58p2","description":"Duplicate Advisory: knowns vulnerable to command injection","datePublished":"Sep 8, 2026, 12:30:22 AM","dateUpdated":"Oct 6, 2026, 6:57:55 PM","baseScore":0.0,"references":"https://github.com/knowns-dev/knowns/security/advisories/GHSA-mc52-mwq4-vfx3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-86540\nhttps://github.com/knowns-dev/knowns/commit/d3989829fb5095666d23d005b2f78a082832a396\nhttps://github.com/knowns-dev/knowns\nhttps://github.com/knowns-dev/knowns/blob/v0.29.1/internal/lsp/detect.go#L128-L157\nhttps://github.com/knowns-dev/knowns/blob/v0.29.1/internal/models/config.go#L205-L216\nhttps://github.com/knowns-dev/knowns/releases/tag/v0.30.0\nhttps://www.vulncheck.com/advisories/knowns-before-0.30.0-arbitrary-code-execution-via-lsp-binary\n","enisa_id":"EUVD-2026-72558\n","aliases":"GHSA-6ph4-r249-58p2\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:52:25 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"5e770720-1d9f-37f5-931a-e7b18dc504a6","vulnerability":{"id":"GHSA-mc52-mwq4-vfx3","description":"knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json","datePublished":"Oct 6, 2026, 6:58:38 PM","dateUpdated":"Oct 6, 2026, 6:58:38 PM","baseScore":0.0,"references":"https://github.com/knowns-dev/knowns/security/advisories/GHSA-mc52-mwq4-vfx3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-86540\nhttps://github.com/knowns-dev/knowns/commit/d3989829fb5095666d23d005b2f78a082832a396\nhttps://github.com/knowns-dev/knowns\nhttps://github.com/knowns-dev/knowns/blob/v0.29.1/internal/lsp/detect.go#L128-L157\nhttps://github.com/knowns-dev/knowns/blob/v0.29.1/internal/models/config.go#L205-L216\nhttps://github.com/knowns-dev/knowns/releases/tag/v0.30.0\nhttps://www.vulncheck.com/advisories/knowns-before-0.30.0-arbitrary-code-execution-via-lsp-binary\n","enisa_id":"EUVD-2026-72558\n","aliases":"CVE-2026-86540\nGHSA-mc52-mwq4-vfx3\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:54:29 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"66b23063-7a9e-315d-abc3-deefe17e28e3","vulnerability":{"id":"CVE-2026-86540","description":"knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user\u0027s account without any verification.","datePublished":"Sep 7, 2026, 11:03:18 PM","dateUpdated":"Sep 24, 2026, 2:21:24 PM","status":"PUBLISHED","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/knowns-dev/knowns/security/advisories/GHSA-mc52-mwq4-vfx3\nhttps://github.com/knowns-dev/knowns/blob/v0.29.1/internal/lsp/detect.go#L128-L157\nhttps://github.com/knowns-dev/knowns/blob/v0.29.1/internal/models/config.go#L205-L216\nhttps://github.com/knowns-dev/knowns/commit/d3989829fb5095666d23d005b2f78a082832a396\nhttps://github.com/knowns-dev/knowns/releases/tag/v0.30.0\nhttps://www.vulncheck.com/advisories/knowns-before-0.30.0-arbitrary-code-execution-via-lsp-binary\n","enisa_id":"EUVD-2026-72558\n","assigner":"VulnCheck","epss":0.21,"dataProcessed":"Nov 9, 2026, 3:06:56 PM","vulnerabilityProduct":[{"id":"1c3f4437-943d-3bd0-8c74-a5597cf84ce4","product":{"name":"knowns","vendor":{"name":"knowns-dev"}},"product_version":"0 \u003c0.30.0"}],"vulnerabilityVendor":[{"id":"eb20fc64-611a-36ce-81c6-27fff23a79a5","vendor":{"name":"knowns-dev"}}]}}],"enisaIdAdvisory":[]}