Description
knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
knowns-dev knowns
Default version status: unaffected
0 to < 0.30.0affected0.30.0unaffected
pkg:npm/knownsReferences
- https://github.com/knowns-dev/knowns/security/advisories/GHSA-mc52-mwq4-vfx3 ↗
- https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/lsp/detect.go#L128-L157 ↗
- https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/models/config.go#L205-L216 ↗
- https://github.com/knowns-dev/knowns/commit/d3989829fb5095666d23d005b2f78a082832a396 ↗
- https://github.com/knowns-dev/knowns/releases/tag/v0.30.0 ↗
- https://www.vulncheck.com/advisories/knowns-before-0.30.0-arbitrary-code-execution-via-lsp-binary ↗