A missing validation check on the x-opencode-directory request header lets unauthenticated remote attackers drive file operations outside the project root on hosts running knowns versions before 0.31.0.
What Is It
CVE-2026-88899 is an external control of file name or path flaw (CWE-73) in knowns, an npm-distributed tool from knowns-dev. Versions before 0.31.0 fail to properly validate the x-opencode-directory request header handled by the /api/opencode proxy endpoint. Because the header value is accepted as-is, a remote attacker can supply an arbitrary directory path and cause file operations to execute outside the intended project root on the host system.
VulnCheck, the disclosing CNA, assigned a CVSS v3.1 base score of 9.8 (Critical): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, alongside a CVSS v4.0 score of 9.3 (Critical). The CVE was published 2026-09-10.
Why It Matters
The attack path requires no privileges, no user interaction, and no special conditions: a single crafted HTTP header to a reachable /api/opencode endpoint is enough. Confidentiality, integrity, and availability impacts are all rated High, meaning a successful attacker can both read and write host filesystem locations the service was never meant to touch.
CVE-2026-88899 is not listed in the CISA Known Exploited Vulnerabilities catalog, so active exploitation is not confirmed and no federal remediation deadline under BOD 22-01 applies. The exploit maturity field in the CVSS v4.0 vector is Not Defined.
What's Vulnerable
- Vendor: knowns-dev
- Product: knowns (
pkg:npm/knowns) - Affected: all versions from 0 up to, but not including, 0.31.0 (semver)
- Unaffected: 0.31.0 and later
No CPE entries were published for this record.
Patch Status
Patched in knowns v0.31.0. The fix is tracked in commit 37db0561b37b48b8bd035a417d7f1da6258ae657, and the vulnerable handler is visible in the v0.30.0 tree at internal/server/server.go lines 1283–1296. Operators running any pre-0.31.0 release should upgrade to 0.31.0 or later. GitHub Security Advisory GHSA-9h2q-r9fh-f98w covers the issue.
Sources
- NVD, CVE-2026-88899: https://nvd.nist.gov/vuln/detail/CVE-2026-88899
- GitHub Security Advisory GHSA-9h2q-r9fh-f98w: https://github.com/knowns-dev/knowns/security/advisories/GHSA-9h2q-r9fh-f98w
- VulnCheck Advisory: https://www.vulncheck.com/advisories/knowns-before-0.31.0-external-control-of-agent-working-directory-via-x-opencode-directory-header
- Fix commit: https://github.com/knowns-dev/knowns/commit/37db0561b37b48b8bd035a417d7f1da6258ae657
- Release v0.31.0: https://github.com/knowns-dev/knowns/releases/tag/v0.31.0
- Vulnerable code (v0.30.0): https://github.com/knowns-dev/knowns/blob/v0.30.0/internal/server/server.go#L1283-L1296
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog