Medium severity · published Sep 10, 2026
CVE-2026-88938
knowns through 0.33.0 Path Traversal via code.find MCP tool
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files anywhere on the host. Attackers can supply absolute paths or relative traversal sequences to the path argument and retrieve full file contents from outside the intended project directory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KN
knowns · knowns-dev
through 0.33.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-88938
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-88938
github.com
https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/mcp/handlers/code.go#L1293-L1354
github.com
https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/mcp/handlers/code.go#L873-L902
github.com
https://github.com/knowns-dev/knowns/security/advisories/GHSA-5cj9-fcqq-g2h7
www.vulncheck.com
https://www.vulncheck.com/advisories/knowns-through-0.33.0-path-traversal-via-code-find-mcp-tool
More from knowns
9.8
CVE-2026-88899
knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header
9.8
CVE-2026-86543
knowns before 0.30.0 Unauthenticated Management API Exposure
9.1
CVE-2026-86542
knowns before 0.30.0 Path Traversal via Import Name
8.8
CVE-2026-88937
knowns through 0.33.0 Path Traversal via Template Engine
8.8
CVE-2026-86439
knowns before 0.30.0 Path Traversal via MCP doc and memory tools