Path traversal flaws let Knowns MCP agent tools escape sandbox

A security advisory published on 25 September 2026 says the Knowns MCP server contains multiple unrestricted path traversal vulnerabilities that let its documentation and memory tools read, write and delete Markdown files outside the project sandbox. The advisory, GHSA-9gfj-28hw-jchp, is tracked as CVE-2026-86439 and covers the npm package knowns. GitHub's advisory database marks the report as verified.

Knowns provides tools over MCP, the Model Context Protocol, which is the interface coding assistants use to call external tools. According to the advisory, the storage layer functions behind those tools — Get, Create, Update, Rename and Delete in both doc_store.go and memory_store.go — join user-controlled paths onto a base directory using Go's filepath.Join() without checking that the result stays inside that directory.

The advisory describes this as a classic containment failure, classified as CWE-22. filepath.Join resolves ../ sequences natively, so a path supplied by a caller can walk up and out of the intended docs folder. The advisory says there is no prefix check after the join, and no rejection of absolute paths or traversal sequences. The memory store has the same problem: the id parameter passed to GetInLayer, Create, Update and Delete is turned straight into a filename with no validation.

The MCP handlers themselves offer no protection. According to the advisory, internal/mcp/handlers/doc.go passes the user-supplied path, folder and newPath values directly to the storage layer, and internal/mcp/handlers/memory.go does the same with id. The advisory calls these pass-through handlers with unsanitised input propagation.

A second issue makes the deletion risk worse. The advisory says the docs.update action, when given a newPath parameter, carries out a file deletion through Rename(), because the rename writes the new file and then calls os.Remove on the old path. But in the permission registry at internal/permissions/registry.go, docs.update is classified as requiring only the write capability, CapWrite, rather than the delete capability, CapDelete. The advisory describes this as a capability misclassification, CWE-863, and says it allows an attacker operating under a read-write-no-delete permission preset to bypass the deletion restriction and destroy arbitrary files outside the project root.

That combination is the part most relevant to agent deployments. Permission presets are the main control operators use to limit what an autonomous coding agent can do to a machine. If a preset that explicitly forbids deletion still permits a deletion path, the control gives a false assurance. Combined with the missing containment checks, the advisory's account means an operation the user believed was scoped to project documentation can remove a file anywhere the server process can reach.

The advisory as published lists the affected files, the root cause and the vulnerable code, but does not state a fixed version or mitigation steps in the material reviewed. Users of the knowns npm package should consult the advisory directly for patch status.