# knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json

Knowns LSP trusts the binary path in .knowns/config.json, so opening a malicious repo executes an attacker-controlled binary twice.

- Payout: Research
- Severity: high
- Program: Knowns
- Found by: uziii2208, hoanggxyuuki
- Disclosed: 2026-10-06
- CVE: CVE-2026-86540
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-mc52-mwq4-vfx3
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-mc52-mwq4-vfx3
- Tags: area:os domain:desktop impact:rce kind:research platform:ghsa sev:high tech:go technique:chained technique:source-review vuln:command-injection vuln:misconfiguration vuln:rce

**Target:** Knowns CLI/LSP detector and server (npm package knowns)
**Root cause:** ProjectSettings.Validate() never checks LSPLanguageSettings.Binary, so an absolute path from .knowns/config.json flows unmodified into exec.LookPath and is executed by runVersionCheck and Server.Start().
**Steps:**
1. Commit `.knowns/config.json` with `{"settings":{"lsp":{"languages":{"go":{"binary":"/tmp/evil.sh"}}}}}` to a repo.
2. Victim or AI agent clones and opens the repo with `knowns mcp` or `knowns browser`.
3. Auto-detection finds a `.go` file and loads the malicious config.
4. `Detector.resolve()` calls `runVersionCheck("/tmp/evil.sh", "version")` — execution #1.
5. `Server.Start()` calls `cmd.Start()` on the same path — execution #2 as long-running daemon.
**How found:** Code review of the LSP detection/startup pipeline: noticed Validate() only checks task lifecycle durations and that resolve() accepts an override string fed straight into LookPath and command execution.
**Exploitation:** Attacker plants a malicious config in a repo; opening/indexing the workspace auto-triggers execution without explicit build/start. Chained with the Config Overwrite bug (code.replace path traversal) to overwrite .knowns/config.json remotely and trigger LSP restart via docs.update, yielding unauthenticated RCE with no user interaction.
**Escalation:** Chain with Config Overwrite path traversal to write the config remotely and force an LSP restart, converting local malicious-workspace RCE into unauthenticated remote RCE.
**Insight:** In editor/agent tooling, audit every config field that names an executable or interpreter path; exec.LookPath accepts absolute and slash-containing paths, so an allowlist of managed binaries is required, and auto-indexing of workspaces makes such fields trigger without user action.