The knowns npm package is affected by a critical path traversal vulnerability that allows unauthenticated attackers to manipulate arbitrary files on the host system.

The vulnerability exists due to improper path normalization in the Document API, where user supplied input is not properly sanitized for traversal sequences before being used in file system operations. This allows an unauthenticated remote attacker to bypass directory restrictions and perform unauthorized file system access.

The ability for an unauthenticated attacker to read, overwrite, or delete files poses a significant risk to data integrity and confidentiality. By manipulating files with a .md extension or creating directories, an attacker could potentially gain unauthorized access to sensitive project documentation or chain this primitive to achieve remote code execution. With a CVSS score of 8.6, this vulnerability represents a high-severity threat that necessitates immediate attention to prevent system compromise.

Immediate Action: Update the knowns package to version 0.30.0 or later to include the necessary path sanitization fixes.

Proactive Monitoring: Monitor server access logs for unusual patterns or payloads containing directory traversal sequences, such as multiple instances of double dots and slashes directed toward the /api/docs endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) to block requests containing path traversal patterns, such as ../, and ensure the application runs with the principle of least privilege to limit the impact of file system access.

Public Exploit Available: No (exploit_available: false)

The severity of this path traversal vulnerability cannot be overstated, as it provides an unauthenticated attacker with broad control over the host file system. Organizations utilizing the knowns package must prioritize upgrading to version 0.30.0 immediately to remediate the flaw. Until the update is applied, ensure the management interface is restricted to trusted networks to minimize exposure to potential exploitation attempts.