CVE-2026-86540 knowns before 0.30.0 Arbitrary Code Execution via LSP Binary
Attackers can execute arbitrary code by tricking users into opening a malicious project configuration file in the knowns tool.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-86540?
CVE-2026-86540 is a high-severity command injection vulnerability in knowns-dev knowns, published on 7 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.
Weakness: CWE-78
Which versions are affected by CVE-2026-86540?
2 open source packages ship an affected version, including knowns.
| Package | Affected | Fixed in |
|---|---|---|
knowns npm | All versions | 0.30.0 |
knowns npm | All versions | 0.30.0 |
How do I fix CVE-2026-86540?
Upgrade knowns to 0.30.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-86540 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-86540 exists.
Sources
Also known as GHSA-mc52-mwq4-vfx3.