Tools AI Risk Radar ai-incident-0151
Incident record
Knowns fixes code execution from malicious project settings
- Severity
- High
- Status
- Patched
- Type
- Infra Vuln
- Target
- knowns
- Actor
- researcher
- CVE
- CVE-2026-86540
What happened
Opening a repository with an attacker-controlled language-server path could start the attacker’s program. The standalone attack requires the user to open that project configuration.
knowns: affected <= 0.29.1; fixed in 0.30.0. The date shown is the maintainer’s original disclosure date. Its advisory assigns 7.8 under CVSS 3.1.
Sources
- Primary disclosuregithub.com/knowns-dev/knowns/security/advisories/GHSA-mc52-m…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026