CVE-2026-86540 — knowns before 0.30.0 Arbitrary Code Execution via LSP Binary
knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafti…
Published: 2026-09-07 · CVSS: 8.5 · CVSS 4.0
knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7