CVE-2026-86544: Knowns-Dev Knowns

High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days.

knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.

Affected products

• Knowns-Dev Knowns: before 0.30.0 (fixed in 0.30.0)

Published 2026-09-07. Last modified 2026-09-09.