What’s Vulnerable › Vulnerabilities

CVE-2026-88937: knowns through 0.33.0 Path Traversal via Template Engine

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-10 · updated 2026-09-10
• Weakness: CWE-22

Description

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside the project root. Attackers can supply malicious templates that traverse directories to overwrite shell profiles, steal credentials, or achieve persistent code execution on victim systems.

Affected products

• knowns-dev knowns: through 0.33.0

References

• https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/codegen/template_engine.go#L318-L344
• https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/codegen/template_engine.go#L625-L636
• https://github.com/knowns-dev/knowns/security/advisories/GHSA-68cq-4rwm-f7jr
• https://github.com/knowns-dev/knowns/security/advisories/GHSA-xjcg-5j3r-m6f9
• https://www.vulncheck.com/advisories/knowns-through-0.33.0-path-traversal-via-template-engine
• https://github.com/knowns-dev/knowns/security/advisories/GHSA-68cq-4rwm-f7jr

Get alerted when CVE-2026-88937 or the next vulnerability affects your stack