CVE-2026-86540: knowns RCE Vulnerability in LSP Config

CVE-2026-86540 Overview

CVE-2026-86540 is a local arbitrary code execution vulnerability in the Knowns developer tool. Versions before 0.30.0 fail to validate the settings.lsp.languages binary field inside project configuration files. An attacker can craft a malicious .knowns/config.json file that specifies an arbitrary binary path. When a victim opens a repository containing this crafted configuration, Knowns executes the unvalidated binary twice under the user's account. No verification or sandboxing is applied. The vulnerability is tracked under [CWE-78] (OS Command Injection). It requires only that the user open a repository, which fits standard developer workflows involving cloned or shared projects.

Critical Impact
Opening a repository with a malicious .knowns/config.json triggers execution of attacker-controlled binaries under the current user's account, enabling full local code execution.

Affected Products

Knowns versions prior to 0.30.0
Knowns v0.29.1 (confirmed vulnerable via referenced source in internal/lsp/detect.go)
Knowns Language Server Protocol (LSP) integration component

Discovery Timeline

2026-09-07 - CVE-2026-86540 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86540

Vulnerability Analysis

The flaw lives in the Knowns Language Server Protocol (LSP) binary resolution logic. When Knowns loads a project, it reads the settings.lsp.languages field from .knowns/config.json. The resolver in internal/lsp/detect.go accepts any string supplied through the override parameter and treats it as the binary to execute. No allowlist check, path validation, or signature verification is performed against the candidate binaries defined for the language.

Because the binary path is derived directly from repository-controlled data, an attacker who ships a poisoned configuration achieves arbitrary command execution. Execution occurs under the developer's user context, granting the attacker access to source code, SSH keys, cloud credentials, and other developer secrets. The behavior of running the binary twice compounds the risk by producing repeated execution attempts within a single project open event.

Root Cause

The root cause is missing input validation on the override parameter passed to the LSP binary resolver. The pre-patch code constructed a Binary{Name: override} value directly from user-supplied configuration data without checking whether override matched a known, trusted candidate name. This maps to [CWE-78] because untrusted input flows into an OS command execution path.

Attack Vector

Exploitation requires local user interaction. The attacker distributes a Git repository, archive, or shared project directory containing a crafted .knowns/config.json. When the victim opens the project in Knowns, the LSP detector reads the configuration and executes the specified binary. Delivery vectors include public repository clones, supply-chain contributions, and shared workspace archives.

// Patch from internal/lsp/binary_override.go (v0.30.0)
// Introduces strict allowlist validation of the override value
package lsp

import (
	"fmt"
	"strings"
)

func selectBinaryCandidateOverride(override string, candidates []BinaryCandidate) (BinaryCandidate, error) {
	if strings.TrimSpace(override) != override || override == "" {
		return BinaryCandidate{}, invalidBinaryOverride(override)
	}
	for _, candidate := range candidates {
		if candidate.Name == override {
			return candidate, nil
		}
	}
	return BinaryCandidate{}, invalidBinaryOverride(override)
}

func selectBinaryOverride(override string, candidates []Binary) (Binary, error) {
	if strings.TrimSpace(override) != override || override == "" {
		return Binary{}, invalidBinaryOverride(override)
	}
	for _, candidate := range candidates {
		if candidate.Name == override {
			return candidate, nil
		}
	}
	return Binary{}, invalidBinaryOverride(override)
}

Source: GitHub Commit d3989829

The patched resolve function in internal/lsp/detect.go now rejects unknown overrides rather than constructing an arbitrary Binary from user input:

 func (d *Detector) resolve(ctx context.Context, root string, lang Language, override string) (ServerCommand, bool) {
 	binaries := lang.Binaries
 	if override != "" {
-		binary := Binary{Name: override}
-		if len(binaries) > 0 {
-			binary.CheckArgs = append([]string(nil), binaries[0].CheckArgs...)
+		binary, err := selectBinaryOverride(override, binaries)
+		if err != nil {
+			return ServerCommand{}, false
 		}
 		binaries = []Binary{binary}
 	}

Source: GitHub Commit d3989829

Detection Methods for CVE-2026-86540

Indicators of Compromise

Presence of .knowns/config.json files containing settings.lsp.languages entries with absolute paths, relative paths, or unusual binary names not matching standard language servers.
Child processes spawned by the Knowns binary that resolve to paths outside expected LSP server install locations.
Repeated execution of the same non-standard binary immediately after a repository is opened in Knowns.

Detection Strategies

Hunt for process-creation events where the parent process is Knowns and the child is not a recognized language server binary (gopls, pyright, rust-analyzer, etc.).
Scan developer endpoints and repository hosting for .knowns/config.json files and flag lsp.languages values that reference shell interpreters, script hosts, or paths under user-writable directories.
Correlate Git clone or archive extraction events with subsequent Knowns process launches to identify the exploitation window.

Monitoring Recommendations

Enable command-line argument logging for all processes spawned by Knowns and forward telemetry to a central analytics platform.
Alert on Knowns spawning binaries from paths such as /tmp, user home directories, or repository working trees.
Track the installed Knowns version across developer workstations and flag any host running a build older than 0.30.0.

How to Mitigate CVE-2026-86540

Immediate Actions Required

Upgrade Knowns to version 0.30.0 or later on all developer workstations and CI runners.
Audit existing repositories for .knowns/config.json files and review any settings.lsp.languages binary values before opening them.
Restrict opening untrusted repositories in Knowns until the upgrade is complete.

Patch Information

The fix ships in Knowns 0.30.0. Commit d3989829 introduces selectBinaryOverride and selectBinaryCandidateOverride in internal/lsp/binary_override.go, enforcing that any override value must match a known candidate name. See the GitHub Release v0.30.0, the GitHub Security Advisory GHSA-mc52-mwq4-vfx3, and the VulnCheck Advisory for Knowns for full details.

Workarounds

Manually remove or sanitize any .knowns/config.json file before opening an untrusted repository, ensuring settings.lsp.languages binary fields reference only trusted, allowlisted names.
Open unknown repositories inside an isolated virtual machine or container without access to sensitive credentials.
Apply endpoint application control to block Knowns from spawning binaries that reside inside repository working directories.

bash

# Verify installed Knowns version and upgrade if below 0.30.0
knowns --version

# Example: identify potentially malicious .knowns/config.json entries
find . -type f -path '*/.knowns/config.json' -print \
  -exec grep -H -n 'languages' {} \;