Knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files. Attackers can craft a malicious .knowns/config.json that specifies an arbitrary binary path; when a repository containing this file is opened, the binary is executed twice under the local user account with no checks. This flaw permits remote code execution on the user's system, represented by CWE‑78, and can compromise confidentiality, integrity, and availability of any system running the vulnerable application.

Any instance of knowns-dev's knowns before version 0.30.0 is impacted. The vulnerability applies to all products that ship the vulnerable configuration handling logic, i.e., knowns project integrators using the default settings without additional validation layers.

With a CVSS score of 8.5 the vulnerability is considered high. EPSS data is not available, and the issue is not currently listed in the CISA KEV catalog. The attack vector is inferred to be client-side, requiring the user to open a repository containing a crafted .knowns/config.json file, which then triggers the execution of an arbitrary binary twice under the user's account. Presence of a local repository or a pull into a local workspace is sufficient to exploit the flaw.