npm/knowns CVE-2026-86540: high 7.8, EPSS 0.21%

knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json

Action: Upgrade knowns to 0.30.0 or later.

npm i knowns@0.30.0

Affected

Fixed versions

Sources

• osv: GHSA-mc52-mwq4-vfx3
• https://github.com/knowns-dev/knowns/security/advisories/GHSA-mc52-mwq4-vfx3
• https://nvd.nist.gov/vuln/detail/CVE-2026-86540
• https://github.com/knowns-dev/knowns/commit/d3989829fb5095666d23d005b2f78a082832a396
• https://github.com/knowns-dev/knowns
• https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/lsp/detect.go#L128-L157
• https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/models/config.go#L205-L216
• https://github.com/knowns-dev/knowns/releases/tag/v0.30.0
• https://www.vulncheck.com/advisories/knowns-before-0.30.0-arbitrary-code-execution-via-lsp-binary

CVE-2026-86540 · published 2026-10-06T18:58:38Z · modified 2026-10-06T19:15:03.494654433Z · JSON