CVE-2026-86540

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-mc52-mwq4-vfx3. This link is maintained to preserve external references.

Original Description

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.

Overview

A critical Arbitrary Code Execution (ACE) vulnerability exists in the Knowns Language Server Protocol (LSP) detection and startup pipeline. The system blindly trusts the settings.lsp.languages.<lang>.binary field defined in the project-level .knowns/config.json file.

Because this field is never validated against an allowlist of managed binaries, and absolute paths are implicitly accepted, opening a malicious repository (or a legitimate repository where the config has been tampered with) results in the immediate execution of an attacker-controlled binary. The payload is executed twice per session: once during the initial runVersionCheck (health check), and again when the LSP server process is spawned via Server.Start(). When chained with the previously identified Config Overwrite vulnerabilities, this flaw yields a fully unauthenticated Remote Code Execution chain.

Affected paths

| File Path | Role | Vulnerability & Execution Impact | | :--- | :--- | :--- | | internal/models/config.go | Validation Gap | Missing Binary Validation (CWE-829): ProjectSettings.Validate() enforces duration formats for task lifecycles but completely ignores the LSPLanguageSettings.Binary field. Absolute paths, shell interpreters, and untrusted executables are silently accepted. | | internal/lsp/detect.go | Execution Sink #1 | Unsanitized Health Check Execution: Detector.resolve() passes the unvalidated override to exec.LookPath(), then invokes runVersionCheck() which blindly calls cmd.Run() on the attacker-controlled binary with CheckArgs. | | internal/lsp/server.go | Execution Sink #2 | Unsanitized LSP Server Spawn: Server.Start() passes the resolved binary path to knownsprocess.Command() and spawns it as a long-running background process via cmd.Start(), executing the payload a second time. |

Root Cause

Missing Validation in Configuration Schema

In internal/models/config.go, the ProjectSettings.Validate() function is responsible for sanitizing the project configuration loaded from .knowns/config.json. However, it only validates task lifecycle durations:

func (s ProjectSettings) Validate() error {
    settings := s.EffectiveTaskLifecycle()
    if _, err := ParseTaskLifecycleDuration(settings.ArchiveAfter); err != nil { ... }
    // NO VALIDATION FOR s.LSP.Languages[lang].Binary
    return nil
}

The LSPLanguageSettings struct exposes a Binary string field. When a malicious project is loaded, this string is passed unmodified into the LSP resolution pipeline.

Blind Execution in LSP Detector

In internal/lsp/detect.go, the Detector.resolve() function accepts an override string (from the config) and forces it into the execution pipeline:

func (d *Detector) resolve(ctx context.Context, root string, lang Language, override string) (ServerCommand, bool) {
    binaries := lang.Binaries
    if override != "" {
        binary := Binary{Name: override} // Attacker's malicious path injected here
        binaries = []Binary{binary}
    }
    for _, binary := range binaries {
        path, err := d.LookPath(binary.Name) // Accepts absolute paths (e.g., /tmp/evil.sh)
        // ...
        err = d.RunCheck(checkCtx, path, binary.CheckArgs...) // EXECUTION #1
        // ...
    }
}

d.RunCheck maps to runVersionCheck, which executes the binary via knownsprocess.CommandContext(ctx, path, args...).Run().

Unrestricted Process Spawn

In internal/lsp/server.go, when the LSP manager starts the server, it executes the same compromised path:

func (s *Server) Start(ctx context.Context) error {
    // ...
    cmd := knownsprocess.Command(s.Command.Path, s.Command.Args...) // EXECUTION #2
    cmd.Dir = s.Root
    // ...
    if err := cmd.Start(); err != nil { ... }
}

Attack Vector

| Phase | Request / Action | Effect | | :--- | :--- | :--- | | 1. Plant | Attacker commits .knowns/config.json containing…

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-mc52-mwq4-vfx3. This link is maintained to preserve external references.

Original Description

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.

Overview

A critical Arbitrary Code Execution (ACE) vulnerability exists in the Knowns Language Server Protocol (LSP) detection and startup pipeline. The system blindly trusts the settings.lsp.languages.<lang>.binary field defined in the project-level .knowns/config.json file.

Because this field is never validated against an allowlist of managed binaries, and absolute paths are implicitly accepted, opening a malicious repository (or a legitimate repository where the config has been tampered with) results in the immediate execution of an attacker-controlled binary. The payload is executed twice per session: once during the initial runVersionCheck (health check), and again when the LSP server process is spawned via Server.Start(). When chained with the previously identified Config Overwrite vulnerabilities, this flaw yields a fully unauthenticated Remote Code Execution chain.

Affected paths

| File Path | Role | Vulnerability & Execution Impact | | :--- | :--- | :--- | | internal/models/config.go | Validation Gap | Missing Binary Validation (CWE-829): ProjectSettings.Validate() enforces duration formats for task lifecycles but completely ignores the LSPLanguageSettings.Binary field. Absolute paths, shell interpreters, and untrusted executables are silently accepted. | | internal/lsp/detect.go | Execution Sink #1 | Unsanitized Health Check Execution: Detector.resolve() passes the unvalidated override to exec.LookPath(), then invokes runVersionCheck() which blindly calls cmd.Run() on the attacker-controlled binary with CheckArgs. | | internal/lsp/server.go | Execution Sink #2 | Unsanitized LSP Server Spawn: Server.Start() passes the resolved binary path to knownsprocess.Command() and spawns it as a long-running background process via cmd.Start(), executing the payload a second time. |

Root Cause

Missing Validation in Configuration Schema

In internal/models/config.go, the ProjectSettings.Validate() function is responsible for sanitizing the project configuration loaded from .knowns/config.json. However, it only validates task lifecycle durations:

func (s ProjectSettings) Validate() error {
    settings := s.EffectiveTaskLifecycle()
    if _, err := ParseTaskLifecycleDuration(settings.ArchiveAfter); err != nil { ... }
    // NO VALIDATION FOR s.LSP.Languages[lang].Binary
    return nil
}

The LSPLanguageSettings struct exposes a Binary string field. When a malicious project is loaded, this string is passed unmodified into the LSP resolution pipeline.

Blind Execution in LSP Detector

In internal/lsp/detect.go, the Detector.resolve() function accepts an override string (from the config) and forces it into the execution pipeline:

func (d *Detector) resolve(ctx context.Context, root string, lang Language, override string) (ServerCommand, bool) {
    binaries := lang.Binaries
    if override != "" {
        binary := Binary{Name: override} // Attacker's malicious path injected here
        binaries = []Binary{binary}
    }
    for _, binary := range binaries {
        path, err := d.LookPath(binary.Name) // Accepts absolute paths (e.g., /tmp/evil.sh)
        // ...
        err = d.RunCheck(checkCtx, path, binary.CheckArgs...) // EXECUTION #1
        // ...
    }
}

d.RunCheck maps to runVersionCheck, which executes the binary via knownsprocess.CommandContext(ctx, path, args...).Run().

Unrestricted Process Spawn

In internal/lsp/server.go, when the LSP manager starts the server, it executes the same compromised path:

func (s *Server) Start(ctx context.Context) error {
    // ...
    cmd := knownsprocess.Command(s.Command.Path, s.Command.Args...) // EXECUTION #2
    cmd.Dir = s.Root
    // ...
    if err := cmd.Start(); err != nil { ... }
}

Attack Vector

| Phase | Request / Action | Effect | | :--- | :--- | :--- | | 1. Plant | Attacker commits .knowns/config.json containing…