Threat · curated 12 Sep 2026
CVE-2026-88899 – Remote File Path Traversal / Sandbox Escape – knowns before v0.31.0
First reported ionix.io
Coverage timeline
Single-source advisory — first reported, latest, and curated coincide.
Why it matters
CVE-2026-88899 shows how an embedded AI coding agent's unvalidated directory header can be weaponized to escape its intended project root and achieve full host compromise with the daemon's privileges, a growing risk class as agentic tools proxy file operations.
CVE-2026-88899 is a critical (CVSS 9.8) external control of file path vulnerability in the `knowns` npm package before v0.31.0, whose `/api/opencode` proxy endpoint fails to validate the `x-opencode-directory` header. Unauthenticated remote attackers can redirect the embedded OpenCode AI agent's file operations to arbitrary host directories (e.g. /root, /etc, ~/.ssh), enabling reading of SSH keys and credentials, writing to shell profiles or cron jobs, and file deletion. The fix in v0.31.0 removed the embedded OpenCode proxy entirely.
Summary
CVE-2026-88899 is a critical (CVSS v3.1 9.8 / v4.0 9.3) external control of file path vulnerability (CWE-73) in the knowns npm package prior to version 0.31.0. The /api/opencode proxy endpoint fails to validate the x-opencode-directory request header (or ?directory query parameter), allowing unauthenticated remote attackers to redirect the embedded OpenCode agent's file operations to arbitrary host directories.[0]
Exploitation requires no authentication and no user interaction against a network-reachable endpoint listening by default on port 4141, enabling reading of sensitive files, writing malicious content, and deletion of arbitrary files with the daemon's OS-level privileges. The issue was fixed in version 0.31.0, which removed the embedded OpenCode proxy entirely; no patch exists for earlier versions, so upgrading is the only complete remediation. The evidence describes a patched disclosure with no report of in-the-wild exploitation or a named actor.[0][2]
Attack chain
- Delivery / Trigger: An unauthenticated attacker sends an HTTP request to the knowns server's /api/opencode endpoint (default port 4141) with a crafted x-opencode-directory header or ?directory query parameter pointing outside the intended project root, such as /root, /etc, or ~/.ssh.[0]
- Exploitation: Because proxyOpenCode() uses fail-open logic and passes the attacker-supplied directory value through unmodified, the OpenCode agent initializes file operations at the attacker-specified path with the daemon's OS-level privileges.[0]
- Impact: The attacker can read sensitive files (SSH keys, credentials, .env files), write malicious content (e.g., to shell profiles or cron jobs), and delete or corrupt arbitrary files, resulting in full compromise of confidentiality, integrity, and availability.[0]
Disclosure timeline
| Date | Event |
|---|---|
| September 10, 2026 | CVE-2026-88899 published/detected as a new CVE by the IONIX Threat Center.[0] |
How it works
The root cause is fail-open input handling in the proxyOpenCode() function in internal/server/server.go. The server only substitutes its own safe activeRoot working directory when the client-supplied directory value is empty; if an attacker supplies any value, it is passed through unmodified to the underlying OpenCode daemon.[0]
An attacker triggers the flaw by sending an HTTP request to /api/opencode with a crafted x-opencode-directory header (or ?directory query parameter) referencing a path outside the intended project root. The OpenCode agent then performs file operations at that path with the daemon's privileges, classified as CWE-73 (external control of file name or path).[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| knowns (npm package, vendor: knowns-dev) | All versions prior to 0.31.0 | Fixed in version 0.31.0, which removed the embedded OpenCode proxy endpoint entirely; no patch exists for earlier versions.[0][2] |
Key takeaways
- Fail-open path handling — substituting a safe default only when input is empty rather than validating attacker-supplied values — turned a proxy directory header into an unauthenticated, full-host file traversal (CVSS 9.8).[0]
- The maintainers resolved the issue by removing the embedded OpenCode proxy entirely in v0.31.0 rather than adding validation, and there is no backported fix, making upgrade the only complete remediation.[0][2]
- The evidence describes a patched disclosure with technical and patch detail but no indication of in-the-wild exploitation or a named threat actor.[0]
Defensive actions
- Upgrade knowns to version 0.31.0 or later.: Version 0.31.0 removed the embedded OpenCode proxy endpoint entirely, and upgrading is the only complete remediation since no patch exists for prior versions.[0][2]
- Restrict network access to the knowns server (default port 4141) to trusted hosts using firewall rules or network segmentation, and do not expose it directly to the internet.: The vulnerable endpoint is network-reachable and requires no authentication, so limiting exposure reduces attack surface when immediate patching is not possible.[0]
- Monitor for HTTP requests to /api/opencode containing unexpected x-opencode-directory header values or directory query parameters referencing paths outside the intended project root.: Such requests are the direct trigger for the path traversal / sandbox escape and would indicate exploitation attempts.[0]