knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine

Published September 10, 2026 CVE-2026-88937

Knowns templates can read local files and overwrite files outside the project. A malicious template could expose credentials or take control of the account running Knowns.

Severity
HighCVSS 3.1 · 8.8
Fix
Not confirmedLast checked yesterday
Affected versions
through 0.33.0
Weakness
CWE-22Path Traversal
Exploit likelihood
0.52% in 30 daysEPSS, higher than 42% of known flaws
Affects
knowns
Exploited
Not confirmedPublic proof of concept, per CISA SSVC
CISA SSVC
Proof of concept publicAutomatable: no · Technical impact: total
EU ID
EUVD-2026-75580ENISA vulnerability database

How it works

  • Someone imports a third-party template repository and runs one of its templates.
  • The template can choose a destination outside the project folder using absolute paths or directory steps.
  • Knowns then reads or writes that file with the user's permissions.
  • The public advisory says this can expose credentials and enable persistent code execution.

What to do

Run npm list knowns in each project or environment using Knowns. Compare the installed version with the affected range through 0.33.0 and the vendor advisory.

Run this in the application environment you want to check:

npm list knowns

The CVE record lists versions through 0.33.0 as affected, while the vendor advisory describes fixes in 0.32.0 and 0.33.0. Review the vendor advisory before choosing the release to install, because the supplied records conflict on the fixed version.

Technical details

CVE-2026-88937 is a path traversal flaw in Knowns' code generation template engine. Absolute paths and directory traversal can escape the project boundary, allowing readable files to be copied and arbitrary files to be changed.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction Required Requires another user to take an action
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source