Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-88940

knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint

CVSS 4.0 6.9 MEDIUMCVSS 3.1 5.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-88940

Published

knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories on the host filesystem. Attackers can traverse the directory structure to locate project directories and identify targets for further exploitation.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-88940

Published

knowns

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "knowns-dev",
                    "product": "knowns",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:npm/knowns",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThanOrEqual": "0.33.0"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON