{"uuid": "713246b2-a8aa-4ad4-9159-eed509dd9210", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-mc52-mwq4-vfx3", "type": "seen", "source": "https://gist.github.com/alon710/2561c2eeb43125d50a9550323198ee8c", "content": "# CVE-2026-86540: CVE-2026-86540: Arbitrary Code Execution via LSP Binary Override in knowns\n\n> **CVSS Score:** 8.5\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-86540\n\n## Summary\nCVE-2026-86540 is a high-severity arbitrary code execution vulnerability in knowns, a repository management tool. The vulnerability occurs when the application parses and executes unvalidated language server binary overrides defined within a project's local configuration file.\n\n## TL;DR\nUnvalidated binary paths in workspace configuration files allow arbitrary command execution when opening a repository in knowns.\n\n## Technical Details\n\n- **CWE ID**: CWE-78\n- **Attack Vector**: Local\n- **CVSS v4.0 Base Score**: 8.5\n- **EPSS Score**: 0.00212\n- **Exploit Status**: none/low\n- **Impact**: Arbitrary Code Execution (ACE)\n\n## Affected Systems\n\n- knowns\n- **knowns**: < 0.30.0 (Fixed in: `0.30.0`)\n\n## Mitigation\n\n- Upgrade knowns to version 0.30.0 or higher.\n- Inspect workspace-level configuration files (.knowns/config.json) for unauthorized lsp binary overrides.\n- Restrict the opening of untrusted repositories in developer workspaces.\n\n**Remediation Steps:**\n1. Download the latest package or build from source for version 0.30.0.\n2. Deploy static analysis or scanning tools to detect .knowns/config.json with binary configurations.\n3. Ensure any local binary configuration is whitelisted according to the new strict selection rules.\n\n## References\n\n- [GitHub Security Advisory GHSA-mc52-mwq4-vfx3](https://github.com/knowns-dev/knowns/security/advisories/GHSA-mc52-mwq4-vfx3)\n- [Fix Commit](https://github.com/knowns-dev/knowns/commit/d3989829fb5095666d23d005b2f78a082832a396)\n- [NVD Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-86540)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-86540) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T19:30:31.000000Z"}