Knowns LSP OS Command Injection via Malicious config.json

A critical arbitrary code execution vulnerability in the Knowns LSP binary allows attackers to execute arbitrary commands by crafting a malicious .knowns/config.json file that specifies an attacker-controlled binary path. The payload executes twice per session during health checks and server startup.

Disclosed 6 October 2026 · Record updated 6 October 2026

Impact

Arbitrary code execution through unsanitized binary path configuration in project-level config.json files

Our coverage

A poisoned blueprint on a desk transforms into a serpent that slithers twice through a locked workshop, executing unseen commands before vanishing.

Vulnerabilities

Malicious repo config triggers code execution in Knowns LSP

A critical flaw disclosed on 6 October 2026 lets a project file point the Knowns language server at any executable, which then runs twice per session.

6 Oct 2026

Sources

github.comhttps://github.com/advisories/GHSA-mc52-mwq4-vfx3