CVE-2026-86439: the knowns MCP server does not validate path arguments, giving traversal write access outside the project
NVD·medium signal
knowns before 0.30.0 fails to validate filesystem paths in MCP tool arguments, so directory-traversal sequences let an attacker read, create, overwrite and delete files outside the project directory, reaching any Markdown file the server process can touch. NVD published it 2026-09-07 and it carries a CVSS 8.8 High rating under CWE-22. Fix is to upgrade to 0.30.0 or later; the pattern is the same unvalidated-argument class that hit OGX, OWL and Rowboat over the past week.