Description
A critical Arbitrary Code Execution (ACE) vulnerability exists in the Knowns Language Server Protocol (LSP) detection and startup pipeline. The system blindly trusts the settings.lsp.languages.<lang>.binary field defined in the project-level .knowns/config.json file.
Recommendation
Update the knowns package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.29.1
- Patched version(s): 0.30.0
References
Could your website be exposed too?
SmartScanner can check your website for knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. - CVE-2026-33442
- SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`. - CVE-2026-32763
- Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()` - CVE-2026-44635
- OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() - CVE-2026-27728
You might also like:
See something that needs correcting? Let us knowUpdated October 06, 2026