CVE-2026-86540: knowns before 0.30.0 Arbitrary Code Execution via LSP Binary
knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
knownsto a version that resolves this vulnerability.Fixed in 0.30.0 - Configuration
Ensure the settings.lsp.languages binary field in the project configuration files points to a legitimate, expected binary (avoid untrusted/crafted paths in .knowns/config.json).
knowns (project configuration files) settings.lsp.languages binary field = valid binary path only
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running knowns versions earlier than 0.30.0 are exposed when they open a repository containing a crafted .knowns/config.json file. The malicious binary executes under the account of the user opening the repository.
What does an attacker need to exploit it?
An attacker needs to provide or modify a repository so that its .knowns/config.json sets the settings.lsp.languages binary field to an attacker-controlled binary path. User interaction is required because the victim must open that repository.
Are affected users protected by normal project-configuration handling?
No. In affected versions, the LSP binary field is not validated or verified before execution, and the configured binary path is executed twice when the repository is opened.