github.com /advisories/GHSA-mc52-mwq4-vfx3

knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json

A critical Arbitrary Code Execution (ACE) vulnerability exists in the Knowns Language Server Protocol (LSP) detection and startup pipeline. The system blindly trusts the settings.lsp.languages. .binary field defined in the project-level .knowns/config.json file.

Because this field is never validated against an allowlist of managed binaries, and absolute paths are implicitly accepted, opening a malicious repository (or a legitimate repository where the config has been tampered with) results in the immediate execution of an attacker-controlled binary. The payload is executed twice per session: once during the initial runVersionCheck (health check), and again when the LSP server process is spawned via Server.Start() . When chained with the previously identified Config Overwrite vulnerabilities, this flaw yields a fully unauthenticated Remote Code Execution chain.

Missing Validation in Configuration Schema

In internal/models/config.go , the ProjectSettings.Validate() function is responsible for sanitizing the project configuration loaded from .knowns/config.json . However, it only validates task lifecycle durations:

The LSPLanguageSettings struct exposes a Binary string field. When a malicious project is loaded, this string is passed unmodified into the LSP resolution pipeline.

Blind Execution in LSP Detector

In internal/lsp/detect.go , the Detector.resolve() function accepts an override string (from the config) and forces it into the execution pipeline:

d.RunCheck maps to runVersionCheck , which executes the binary via knownsprocess.CommandContext(ctx, path, args...).Run() .

Unrestricted Process Spawn

In internal/lsp/server.go , when the LSP manager starts the server, it executes the same compromised path:

Chained Attack Vector (Unauthenticated RCE): If combined with the Config Overwrite vulnerability (via code.replace path traversal), a remote attacker can overwrite .knowns/config.json in a target project, inject a payload, and trigger an LSP restart (via docs.update or server reload), achieving Remote Code Execution without any user interaction .

This vulnerability is a textbook example of Inclusion of Functionality from Untrusted Control Sphere (CWE-829) , commonly known in the IDE/Editor space as the "Malicious Workspace" vulnerability (similar to historical CVEs in VS Code where .vscode/settings.json could point to malicious interpreter paths).

The core failure is the lack of a strict allowlist for executable paths. By relying on exec.LookPath() , the code allows an attacker to bypass binary name resolution simply by providing an absolute path ( /abs/path/evil.sh ) or a path containing a slash ( ./evil.sh ).

Furthermore, the execution happens automatically upon project load. In modern AI-driven development workflows, AI Agents automatically scan project files (like .go , .ts , .py ) to provide context. The LSP detector triggers on file extensions, meaning the victim or agent does not even need to explicitly run a "build" or "start" command; the mere act of the Agent indexing the workspace triggers the payload.

Patch is available right now at New Release .

knowns-dev/knowns@ d398982