CVE-2026-120325
Description
A flaw was found in Knip. An attacker could exploit a path traversal vulnerability by providing a manipulated workspaces configuration during file writing operations. This flaw allows unauthorized modification or overwriting of files outside the intended project directory.
Statement
Red Hat Product Security has rated this vulnerability as Important because successful exploitation allows an attacker to overwrite arbitrary files outside the repository boundary with the permissions of the running user, leading to integrity loss or arbitrary code execution. The issue is triggered only when Knip processes a project containing maliciously crafted workspace parameters, requiring local user interaction to analyze untrusted code. Production environments and deployed services are typically unaffected unless Knip is invoked directly during build or development workflows on untrusted sources.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to canonicalize workspace configuration paths and confine file modification operations strictly to the project root directory before passing paths to IssueFixer writeFile: upgrade to the fixed Grafana builds, which enforces workspace path containment within the current working directory before scanning or mutating files, closing all 2 injection vectors (directory traversal sequences in workspace configuration, absolute paths in workspace configuration). Until patched, this is a concern on developer and build workflows running Knip on untrusted repositories or workspaces, so avoid running knip or knip --fix on untrusted repositories and ensure workspace configuration files such as package.json and knip.json are vetted. As a compensating measure, detect anomalous file overwrite operations performed by the Node.js or knip process outside standard development directories via EDR, detect write operations into sensitive host paths initiated by the knip process at runtime using Falco or eBPF, and detect unauthorized changes to monitored system files using AIDE or file integrity monitoring. These controls limit blast radius and contain exploitation, but they do not fix the underlying path-traversal defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.1 | N/A | 6.3 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | Low |
| Integrity Impact | High | N/A | Low |
| Availability Impact | High | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RC:C
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
Integrity
Technical Impact: Modify Files or Directories
The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow an attacker to bypass authentication.
Confidentiality
Technical Impact: Read Files or Directories
The attacker may be able to read the contents of unexpected files and expose sensitive data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing attacks in order to break into an account on the system.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the product from working at all and in the case of protection mechanisms such as authentication, it has the potential to lock out product users.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
