Path Traversal Vulnerability in Knowns Template Engine

CVE-2026-88937

What is CVE-2026-88937?

The vulnerability in Knowns, present in version 0.33.0, stems from improper validation of template destination paths within its code generation template engine. This flaw allows attackers to supply malicious templates capable of traversing directories beyond the project root, potentially leading to unauthorized reading and writing of files. Such exploitation can compromise shell profiles, facilitate credential theft, or enable persistent code execution on the systems affected. It is crucial for administrators to address this vulnerability to safeguard their environments.

References