CVE-2026-86439: Knowns MCP tools access files outside the project

Tracking: CVE-2026-86439
Severity: High

Who is affected

The npm package knowns through 0.29.1. An attacker must be able to supply paths to the affected documentation or memory tools.

How the attack works

The tools join a project directory with a caller-supplied path without verifying that the result stays inside the project. Traversal can therefore read, write, or delete accessible .md files elsewhere on the host. Filesystem permissions still limit the reachable data.

A related permission mismatch affects docs.update: its newPath rename operation is classified as a write, even though renaming removes the original path. That can bypass a policy permitting writes but forbidding deletion.

What to do

1. Upgrade to 0.30.0 or later and restart the tool server.
2. Review documentation and memory tool calls for traversal paths and unexpected newPath values. Check Markdown files outside the intended workspace for changes.
3. Limit the server's filesystem access. Review policy assumptions around rename operations as well as explicit delete tools.

Scope and limits

The documented arbitrary-file impact concerns Markdown files. It should not be broadened to unrestricted access to every file type.

Sources

• Original advisory or incident report