{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-88938",
    "name": "CVE-2026-88938",
    "vendor": "knowns",
    "description": "knowns through 0.33.0 fails to confine the path argument of its code.find MCP tool to the project root, so an AI agent session can supply absolute paths or ../ traversal sequences and retrieve source file contents from anywhere the server process can read. VulnCheck assigned CVE-2026-88938 (published 10 September 2026; CVSS 4.0 base 7.1 / CVSS 3.1 6.5) as GHSA-5cj9-fcqq-g2h7 (advisory dated 9 September 2026). The root cause is that handleCodeFind bypasses safepath.ResolveProject — the containment helper every other LSP and code-mutation handler in the same file already uses — and findCodeFiles resolves the search base with raw filepath.Join / filepath.IsAbs instead. code.find is classified CapRead/RiskLow and is available under every permission preset including PresetReadOnly, so no elevated privilege is required. Impact is confidentiality of source trees that routinely hold hardcoded credentials and internal URLs; write handlers remain correctly sandboxed. At GHSA publication no patched version was listed; third-party trackers recommend upgrading past 0.33.0 when a fix lands.",
    "website": "https://www.vulncheck.com/advisories/knowns-through-0.33.0-path-traversal-via-code-find-mcp-tool",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "unknown",
      "packageName": "knowns",
      "command": null
    },
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-09-10",
    "risk": {
      "score": 71,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-88938",
      "aliases": [
        "ti-099",
        "GHSA-5cj9-fcqq-g2h7"
      ],
      "title": "CVE-2026-88938: knowns code.find MCP Tool Reads Any Source File Outside the Project Root (CVSS 7.1)",
      "summary": "knowns through 0.33.0 fails to confine the path argument of its code.find MCP tool to the project root, so an AI agent session can supply absolute paths or ../ traversal sequences and retrieve source file contents from anywhere the server process can read. VulnCheck assigned CVE-2026-88938 (published 10 September 2026; CVSS 4.0 base 7.1 / CVSS 3.1 6.5) as GHSA-5cj9-fcqq-g2h7 (advisory dated 9 September 2026). The root cause is that handleCodeFind bypasses safepath.ResolveProject — the containment helper every other LSP and code-mutation handler in the same file already uses — and findCodeFiles resolves the search base with raw filepath.Join / filepath.IsAbs instead. code.find is classified CapRead/RiskLow and is available under every permission preset including PresetReadOnly, so no elevated privilege is required. Impact is confidentiality of source trees that routinely hold hardcoded credentials and internal URLs; write handlers remain correctly sandboxed. At GHSA publication no patched version was listed; third-party trackers recommend upgrading past 0.33.0 when a fix lands.",
      "severity": "high",
      "cvss": {
        "score": 7.1,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Path traversal",
        "Data exfiltration"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "knowns",
        "vendor": null,
        "package": "knowns",
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "<=0.33.0",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-09-10",
      "modifiedAt": "2026-09-10",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "advisory",
          "url": "https://www.vulncheck.com/advisories/knowns-through-0.33.0-path-traversal-via-code-find-mcp-tool"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88938"
        },
        {
          "type": "advisory",
          "url": "https://github.com/advisories/GHSA-5cj9-fcqq-g2h7"
        }
      ],
      "mitigation": "Until a patched knowns release is confirmed, do not expose code.find to untrusted agent sessions: drop the tool from the enabled set, or wrap the MCP host so path arguments are rejected unless safepath-equivalent containment succeeds. Treat any session that could invoke code.find on a vulnerable build as having had read access to every source tree the process user can reach, and rotate secrets that lived in those trees. Longer term, treat \"one handler skipped the shared path helper\" as a review checklist item for every MCP code-intelligence server you run — the safe handlers in the same file already showed the correct pattern.",
      "detectedByAnomity": true
    }
  }
}