---
id: CVE-2026-86439
title: >-
  knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool
  arguments, allowing attackers to read, create, overwrite and delete files
  outside the project directory
summary: >-
  knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool
  arguments, allowing attackers to read, create, overwrite and delete files
  outside the project directory. Attackers can supply path arguments containing
  directory…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-22
  - CWE-306
  - CWE-863
vendor: knowns-dev
product: knowns
affected:
  - knowns < 0.30.0
published: '2026-09-07'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T19:56:50.950'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86439'
references:
  - url: >-
      https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/storage/doc_store.go#L124-L129
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/storage/memory_store.go#L203-L211
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/knowns-dev/knowns/commit/09c5a96fd5817b941dc86669278c1a17db10ed4e
    label: disclosure@vulncheck.com
  - url: 'https://github.com/knowns-dev/knowns/releases/tag/v0.30.0'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/knowns-dev/knowns/security/advisories/GHSA-9gfj-28hw-jchp
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/knowns-before-0.30.0-path-traversal-via-mcp-doc-and-memory-tools
    label: disclosure@vulncheck.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86439'
  - url: 'https://github.com/advisories/GHSA-9gfj-28hw-jchp'
tags:
  - nvd
  - cve.org
  - ghsa
  - npm
epss: 0.01079
epssPercentile: 0.63626
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-08T12:44:18.439489Z'
ingestedAt: '2026-09-08T15:33:26.980Z'
aliases:
  - GHSA-9gfj-28hw-jchp
ecosystem: npm
patched:
  - knowns 0.30.0
---

## Overview

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files accessible to the server process.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-86439)

Affected packages:

- `knowns <= 0.29.1`

Patched in:

- `knowns 0.30.0`

Source: https://github.com/advisories/GHSA-9gfj-28hw-jchp