A critical command injection vulnerability in knowns versions prior to 0.30.0 allows unauthenticated attackers to execute arbitrary code on the host system.

The application fails to perform input validation on the binary field within the LSP (Language Server Protocol) configuration settings. An attacker can supply a malicious path in the .knowns/config.json file, which triggers the execution of an arbitrary binary under the context of the user running the software.

Successful exploitation allows an attacker to achieve arbitrary code execution on the victim's machine. This level of access could lead to full system compromise, exfiltration of sensitive project data, or the installation of persistent malicious software. Given the CVSS score of 7.8, this vulnerability represents a significant risk to organizational integrity and data confidentiality.

Immediate Action: Upgrade to knowns version 0.30.0 or later immediately to incorporate the necessary binary validation logic.

Proactive Monitoring: Review file system changes for the creation or modification of unexpected .knowns/config.json files in untrusted or shared repositories.

Compensating Controls: Ensure that users operate with the principle of least privilege, limiting the potential impact if a malicious configuration file is executed.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing the knowns development tool must prioritize the update to version 0.30.0. Because this vulnerability allows for arbitrary command execution via a project configuration file, it is imperative to audit any shared or externally sourced repositories for suspicious .knowns/config.json files before opening them in the application.