CVE-2026-86540

Received Received - Intake

Arbitrary Code Execution in Knowns via Unvalidated Binary Path

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-09-07

Generated

2026-09-08

AI Q&A

2026-09-08

EPSS Evaluated

N/A

NVD

CVE-2026-86540

EUVD

EUVD-2026-72558

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability affects versions of a software before 0.30.0. It fails to validate the settings.lsp.languages binary field in project configuration files. Attackers can exploit this by creating a malicious .knowns/config.json file. When a repository with this file is opened, the unvalidated binary path is executed twice under the user's account without any checks.

Detection Guidance

Check for knowns versions before 0.30.0 by inspecting project configuration files for .knowns/config.json. Look for unvalidated settings.lsp.languages binary fields that may point to suspicious executable paths.

Impact Analysis

An attacker could execute arbitrary binaries on your system by tricking you into opening a repository with a malicious configuration file. This could lead to unauthorized code execution, data theft, or further compromise of your system.

Mitigation Strategies

Upgrade knowns to version 0.30.0 or later. Review and remove any untrusted .knowns/config.json files in repositories. Audit system for unauthorized binary executions.

Hi! I’m here to help you understand CVE-2026-86540. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70