CVE-2026-88899: Knowns-Dev Knowns

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system.

Affected products

• Knowns-Dev Knowns: before 0.31.0 (fixed in 0.31.0)

Published 2026-09-10. Last modified 2026-09-11.