CVE-2026-86540: knowns Package Arbitrary Code Execution via Insecure LSP Binary Path Configuration
Summary
CVE-2026-86540: knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json. Affects knowns versions < 0.30.0. Fixed in 0.30.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The knowns package is an open-source tool designed for managing Language Server Protocol (LSP) configurations in development environments. It allows developers to define language-specific settings and manage binaries for various programming languages. However, a critical vulnerability exists in its configuration handling, specifically in the way it processes binary paths defined in the .knowns/config.json file.
Vulnerability Detail
A critical Arbitrary Code Execution (ACE) vulnerability arises from the lack of validation for the 'settings.lsp.languages.<lang>.binary' field in the .knowns/config.json file. This oversight allows attackers to specify malicious binaries that are executed without any checks. The vulnerability is triggered when a project with a compromised configuration is opened, leading to the execution of the attacker's code during health checks and LSP server startup. The flaw is compounded by the potential for remote code execution through previously identified configuration overwrite vulnerabilities, allowing attackers to exploit this issue without user interaction.
How To Fix
Minimum fixed version
0.30.0
This is the first release that contains the fix.
npm install knowns@0.30.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid opening projects from untrusted sources or ensure that the .knowns/config.json file does not contain any untrusted binary paths. Manually inspect the configuration file for any suspicious entries.
Conclusion
CVE-2026-86540 represents a significant security risk for users of the knowns package due to its arbitrary code execution vulnerability stemming from insecure binary path configurations. Users are strongly advised to update to the patched version to safeguard their systems against potential exploits.
See every vulnerability recorded for knowns →
FAQ
CVE-2026-86540 is a vulnerability in the knowns package that allows arbitrary code execution due to insecure handling of binary paths in the configuration file.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without any signup.
The vulnerability can lead to arbitrary code execution, allowing attackers to run malicious code on the victim's machine, potentially compromising sensitive data and system integrity.
Yes, a patch is available in version 0.30.0 of the knowns package. It is recommended to update to this version to mitigate the vulnerability.
If immediate updating is not possible, avoid using untrusted configurations and manually inspect the .knowns/config.json file for any malicious entries.
References
Related vulnerabilities
Recent vulnerabilities recorded for knowns.
