RCE Vulnerability in Knowns LSP Configuration

• •CVE-2026-86540 allows arbitrary code execution via insecure LSP configuration.
• •Vulnerability affects any project using Knowns LSP with unvalidated binary paths.
• •No active exploitation reported, but the vulnerability is critical with a CVSS of 8.5.

An Arbitrary Code Execution (ACE) vulnerability, CVE-2026-86540, has been identified in the Knowns Language Server Protocol (LSP) detection pipeline. The flaw arises from the system's failure to validate the.binary field in the.knowns/config.json file, allowing execution of attacker-controlled binaries. This vulnerability can be exploited by opening a malicious or compromised repository, leading to immediate execution of malicious code. The payload is executed twice per session, enabling a fully unauthenticated Remote Code Execution chain when combined with existing Config Overwrite vulnerabilities. The vulnerability is categorized as due to its potential for, with a CVSS score of 8.5. As of now, there are no reports of in the wild, but the flaw remains. Security professionals are advised to review their configurations and apply necessary mitigations.