HIGH 8.6 NVD
CVE-2026-88937
knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitra
knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside the project root. Attackers can supply malicious templates that traverse directories to overwrite shell profiles, steal credentials, or achieve persistent code execution on victim systems.
References
- https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/codegen/template_engine.go#L318
- https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/codegen/template_engine.go#L625
- https://github.com/knowns-dev/knowns/security/advisories/GHSA-68cq-4rwm-f7jr
- https://github.com/knowns-dev/knowns/security/advisories/GHSA-xjcg-5j3r-m6f9
- https://www.vulncheck.com/advisories/knowns-through-0.33.0-path-traversal-via-template-eng
This high severity vulnerability with a CVSS score of 8.6 was published on 2026-09-10 via NVD.
vulnfeed aggregates 12842 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.