This vulnerability allows an attacker with only read‑only agent session privileges to bypass the permission guard for the project.set action. Because the action is exempt from checks, the attacker can redirect the server to a different project directory and gain write access, effectively contaminating or overwriting project data.

The affected product is knowns from the vendor knowns-dev. All releases up to and including version 0.33.0 contain the flaw; versions after 0.33.0 are presumed patched unless otherwise noted.

The CVSS score of 8.7 indicates a high severity vulnerability with a high impact on confidentiality, integrity, and availability. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote API or service call to project.set performed by an attacker who can establish a read‑only agent session. The vulnerability is exploitable without additional prerequisites beyond possessing the ability to invoke project.set, making it a significant risk for environments with exposed agent interfaces.