Skip to main content
Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack TechniqueRead More
Vulnerability Database/CVE-2026-86541

CVE-2026-86541: knowns Path Traversal Vulnerability

CVE-2026-86541 is a path traversal flaw in knowns versions before 0.30.0 that allows attackers to overwrite arbitrary files outside the project root. This post explains its impact, affected versions, and mitigation steps.

Published:

CVE-2026-86541 Overview

CVE-2026-86541 is a path traversal vulnerability [CWE-22] in the knowns developer tool from knowns-dev. Versions prior to 0.30.0 contain a flaw in the handleCodeReplace() function within internal/mcp/handlers/code.go. The function fails to validate file paths supplied through the Model Context Protocol (MCP) code.replace action. Attackers can pass absolute paths or relative paths containing ../ sequences to write arbitrary content outside the project root. Sensitive targets include shell startup scripts such as ~/.bashrc and SSH configuration files like ~/.ssh/authorized_keys.

Critical Impact

Successful exploitation enables arbitrary file overwrite outside the project boundary, leading to persistence and potential code execution on the developer's host.

Affected Products

  • knowns (knowns-dev) versions prior to 0.30.0
  • Vulnerable code path: internal/mcp/handlers/code.go (lines 588–646 in v0.29.1)
  • MCP code.replace handler exposed to connected LLM clients

Discovery Timeline

  • 2026-09-07 - CVE-2026-86541 published to the National Vulnerability Database
  • 2026-09-10 - Last updated in NVD database
  • Release v0.30.0 - knowns-dev published the fixed release via GitHub Release v0.30.0 and GHSA-f539-xgc6-xw7q

Technical Details for CVE-2026-86541

Vulnerability Analysis

The knowns tool exposes an MCP handler that lets an LLM client rewrite code files inside a project. The handleCodeReplace() function accepts a caller-supplied file path and writes replacement content to it. Prior to v0.30.0, the handler performs no canonicalization or containment check against the project root. Any path the client sends is passed straight to file write routines. Because MCP clients can be driven by untrusted prompts or attacker-influenced context, a malicious instruction can weaponize the handler to reach files outside the workspace. See the VulnCheck Path Traversal Advisory for advisory detail.

Root Cause

The root cause is missing path validation in handleCodeReplace(). The handler does not reject absolute paths, does not resolve symlinks, and does not verify that the cleaned path remains a descendant of the project root. This is a classic path traversal weakness [CWE-22]. The upstream fix reclassifies code.replace, code.replace_body, code.insert, and code.rename as CapWrite / RiskHigh and code.delete as CapDelete / RiskHigh, gating these mutations behind the permission registry.

Attack Vector

Exploitation requires an active MCP session with the knowns server and user interaction to approve or run an LLM-driven action. An attacker who can influence prompts, tool descriptions, or retrieved context supplied to the model can cause the client to invoke code.replace with a target such as ../../../../home/<user>/.ssh/authorized_keys or /home/<user>/.bashrc. The handler writes attacker-controlled content to that location, yielding persistence, credential implantation, or code execution the next time the shell or SSH service consumes the modified file.

go
// Patch: internal/permissions/registry.go
// Fix reclassifies mutating code actions as write/delete operations
// and adds them to the permission registry so they are gated.
"code.search":          {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
"code.symbols":         {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
"code.deps":            {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
"code.graph":           {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
"code.find":            {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
"code.definition":      {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
"code.references":      {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
"code.implementations": {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
"code.diagnostics":     {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
"code.rename":          {Capability: CapWrite,  Target: TargetCode, Risk: RiskHigh},
"code.replace":         {Capability: CapWrite,  Target: TargetCode, Risk: RiskHigh},
"code.replace_body":    {Capability: CapWrite,  Target: TargetCode, Risk: RiskHigh},
"code.insert":          {Capability: CapWrite,  Target: TargetCode, Risk: RiskHigh},
"code.delete":          {Capability: CapDelete, Target: TargetCode, Risk: RiskHigh},
// Source: GitHub commit a2c98fc5c313463576c9348beeec6a74ddd7333b

See the vulnerable snippet at GitHub Code Snippet and the full GitHub Commit Details.

Detection Methods for CVE-2026-86541

Indicators of Compromise

  • Unexpected modifications to ~/.bashrc, ~/.zshrc, ~/.profile, or /etc/profile.d/* on hosts that run the knowns MCP server.
  • New or altered entries in ~/.ssh/authorized_keys, ~/.ssh/config, or ~/.ssh/known_hosts.
  • MCP request logs containing code.replace invocations with path values that begin with /, ~, or include .. sequences.
  • File writes performed by the knowns process to paths outside the current project working directory.

Detection Strategies

  • Enable verbose MCP action logging on the knowns server and alert on any code.replace, code.insert, or code.replace_body action whose target path resolves outside the project root.
  • Deploy file integrity monitoring on developer workstation dotfiles and SSH configuration directories.
  • Baseline the child-process and file-write behavior of the knowns binary and flag deviations that touch user home directory configuration files.

Monitoring Recommendations

  • Forward MCP handler logs and endpoint file-modification telemetry to a central analytics backend for correlation across developer hosts.
  • Track the installed version of knowns across the developer fleet and alert on any host still running a release prior to 0.30.0.
  • Correlate knowns process activity with subsequent SSH authentication events or new interactive shell sessions to surface post-exploitation persistence.

How to Mitigate CVE-2026-86541

Immediate Actions Required

  • Upgrade all installations of knowns to v0.30.0 or later using the release published at GitHub Release v0.30.0.
  • Audit ~/.bashrc, ~/.zshrc, and ~/.ssh/ on any host that ran a vulnerable version connected to an untrusted MCP client or untrusted context source.
  • Rotate SSH keys and revoke unexpected authorized_keys entries discovered during the audit.
  • Review MCP session history for code.replace calls with suspicious path arguments.

Patch Information

The fix is delivered in knowns release v0.30.0. The upstream commit a2c98fc5c313463576c9348beeec6a74ddd7333b adds code.replace, code.replace_body, code.insert, code.rename, and code.delete to the permission registry with RiskHigh classification, forcing them through the capability gate. Refer to advisory GHSA-f539-xgc6-xw7q for the coordinated disclosure record.

Workarounds

  • If upgrading immediately is not possible, disable the code.replace MCP action or restrict the knowns server to trusted local clients only.
  • Run the knowns process under a dedicated low-privilege user account whose home directory contains no shell startup files or SSH keys.
  • Execute knowns inside a container or sandbox that bind-mounts only the intended project directory read-write and mounts the host filesystem read-only.
  • Require explicit human approval for any MCP write action until the patched version is deployed.
bash
# Verify the installed version and upgrade
knowns --version

# Example: run knowns confined to a single project directory
docker run --rm -it \
  --user 1000:1000 \
  --read-only \
  -v "$(pwd)/project:/workspace:rw" \
  -w /workspace \
  knowns-dev/knowns:0.30.0

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne