CVE-2026-86540CWE-78command-injection

CVE-2026-86540

High · published September 8, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
11.0
In the wild
Unconfirmed
What it is

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
8.5 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00212 · 11.0th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-08T03:16Z
References (6)
https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/lsp/detect.go#L128-L157 · [email protected]https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/models/config.go#L205-L216 · [email protected]https://github.com/knowns-dev/knowns/commit/d3989829fb5095666d23d005b2f78a082832a396 · [email protected]https://github.com/knowns-dev/knowns/releases/tag/v0.30.0 · [email protected]https://github.com/knowns-dev/knowns/security/advisories/GHSA-mc52-mwq4-vfx3 · [email protected]https://www.vulncheck.com/advisories/knowns-before-0.30.0-arbitrary-code-execution-via-lsp-binary · [email protected]
EPSS history
Timeline
  • 09 SEP 03:20Z
    EPSS moved — → 0%
    epss
  • 07 SEP 23:03Z
    knowns before 0.30.0 Arbitrary Code Execution via LSP Binary
    cvelistv5