# CVE-2026-88938: CVE-2026-88938: knowns code.find MCP Tool Reads Any Source File Outside the Project Root (CVSS 7.1)

> CVE-2026-88938 is a high-severity path traversal issue (CVSS 7.1) in knowns, a MCP server. Affected: <=0.33.0.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-88938
- **Aliases:** ti-099, GHSA-5cj9-fcqq-g2h7
- **Severity:** high
- **CVSS:** 7.1
- **Attack type:** Path traversal, Data exfiltration
- **Component:** knowns (MCP server)
- **Package:** knowns
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-09-10
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-88938

## Summary

knowns through 0.33.0 fails to confine the path argument of its code.find MCP tool to the project root, so an AI agent session can supply absolute paths or ../ traversal sequences and retrieve source file contents from anywhere the server process can read. VulnCheck assigned CVE-2026-88938 (published 10 September 2026; CVSS 4.0 base 7.1 / CVSS 3.1 6.5) as GHSA-5cj9-fcqq-g2h7 (advisory dated 9 September 2026). The root cause is that handleCodeFind bypasses safepath.ResolveProject — the containment helper every other LSP and code-mutation handler in the same file already uses — and findCodeFiles resolves the search base with raw filepath.Join / filepath.IsAbs instead. code.find is classified CapRead/RiskLow and is available under every permission preset including PresetReadOnly, so no elevated privilege is required. Impact is confidentiality of source trees that routinely hold hardcoded credentials and internal URLs; write handlers remain correctly sandboxed. At GHSA publication no patched version was listed; third-party trackers recommend upgrading past 0.33.0 when a fix lands.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| <=0.33.0 | no fixed version listed |

## Am I affected by CVE-2026-88938?

You are affected if you run knowns <=0.33.0.

## How do I fix CVE-2026-88938?

Until a patched knowns release is confirmed, do not expose code.find to untrusted agent sessions: drop the tool from the enabled set, or wrap the MCP host so path arguments are rejected unless safepath-equivalent containment succeeds. Treat any session that could invoke code.find on a vulnerable build as having had read access to every source tree the process user can reach, and rotate secrets that lived in those trees. Longer term, treat "one handler skipped the shared path helper" as a review checklist item for every MCP code-intelligence server you run — the safe handlers in the same file already showed the correct pattern.

## How do I find every machine running knowns?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run knowns and which version, then enforce a policy on it.

## References

- advisory: https://www.vulncheck.com/advisories/knowns-through-0.33.0-path-traversal-via-code-find-mcp-tool
- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-88938
- advisory: https://github.com/advisories/GHSA-5cj9-fcqq-g2h7

## Related vulnerabilities

- [CVE-2026-73498](https://catalog.anomity.ai/vuln/cve-2026-73498) — high
- [GHSA-53mr-w429-c597](https://catalog.anomity.ai/vuln/ghsa-53mr-w429-c597) — high
- [CVE-2026-57496](https://catalog.anomity.ai/vuln/cve-2026-57496) — high
- [CVE-2026-88066](https://catalog.anomity.ai/vuln/cve-2026-88066) — high
- [ghostsplice-malicious-mcp-servers-split-one-instruction-across-two](https://catalog.anomity.ai/vuln/ghostsplice-malicious-mcp-servers-split-one-instruction-across-two) — high
- [a-hidden-pull-request-comment-turns-your-ai-reviewer-into-the-attacker](https://catalog.anomity.ai/vuln/a-hidden-pull-request-comment-turns-your-ai-reviewer-into-the-attacker) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-88938