CyberRota Analysis
AI-GeneratedVersions prior to 0.30.0 of the affected product fail to validate the `settings.lsp.languages` binary field in project configuration files, which can be exploited by attackers to execute arbitrary binaries through a malicious `.knowns/config.json` file. This vulnerability allows the crafted binary path to be executed twice under the user's account, posing a significant risk of unauthorized code execution. Organizations using these versions should prioritize patching to mitigate the potential for exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.