Path traversal flaws in knowns let AI agents read any file

Three vulnerabilities disclosed in the developer tool knowns allow attackers to read, create, overwrite and delete files outside the project directory, and to bypass read-only restrictions on AI agent sessions. The first, CVE-2026-86439, was published by the US National Vulnerability Database on 7 September 2026 and affects all versions before 0.30.0. Two more, CVE-2026-88938 and CVE-2026-88939, were published on 10 September 2026 and affect versions through 0.33.0.

knowns is maintained by knowns-dev and exposes tools to AI coding agents over MCP, the Model Context Protocol, a standard interface that lets a model call software functions. The common thread in all three issues is that path arguments supplied through those tool calls were not properly confined to the project the server was supposed to be working on.

According to the NVD entry for CVE-2026-86439, versions before 0.30.0 "fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory". The advisory says attackers can supply path arguments containing directory traversal sequences, the familiar pattern of dot-dot-slash segments that walk up a directory tree, to reach arbitrary Markdown files accessible to the server process. A VulnCheck advisory listed in the references describes the problem as sitting in the project's document and memory tools, and the NVD entry references source lines in the document store and memory store of version 0.29.1, along with a commit and the release tag for version 0.30.0. The same flaw is tracked on GitHub as GHSA-qjrq-cvv4-3g9w and GHSA-9gfj-28hw-jchp.

The second issue, CVE-2026-88938, shows the problem was not fully closed. According to the NVD, knowns through 0.33.0 "fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files anywhere on the host". Attackers can pass either absolute paths or relative traversal sequences and retrieve full file contents from outside the intended directory. The advisory references handler code in version 0.33.0 and is tracked as GHSA-5cj9-fcqq-g2h7 and GHSA-629c-j52g-h978.

The third, CVE-2026-88939, is a permissions problem rather than a path problem. The GitHub advisory GHSA-qwj4-f78f-jj3j says knowns through 0.33.0 "exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypass restrictions". An attacker can call project.set to repoint the server at a different project directory and gain write access. In practice that means a session that was meant to look but not touch can be turned into one that can change files.

Taken together, the advisories describe a tool boundary that did not hold. Agent frameworks often rely on a project root as the main safety control, on the assumption that an agent confined to one directory cannot reach credentials, keys or unrelated source code elsewhere on the machine. Here the root was advisory rather than enforced, in both the file-reading tools and the permission layer that was supposed to sit above them.

The NVD references indicate the first issue was addressed in release 0.30.0. The advisories for the two later CVEs list affected versions through 0.33.0 and do not name a fixed release. The incident record for this cluster lists the status as reported.