CVE-2026-88899 Details

A vulnerability exists in Knowns versions prior to 0.31.0, where the OpenCode proxy endpoint fails to properly validate the 'x-opencode-directory' request header. This oversight allows remote attackers to specify arbitrary directory paths, enabling file operations outside the designated project root on the host system. The issue arises because the proxy only injects the project directory when the header is empty, allowing client-supplied values to pass through unmodified. As a result, an attacker can manipulate the OpenCode AI agent's working directory to access, modify, or execute files in sensitive locations, including system directories and credential stores.

Upgrade to Knowns version 0.31.0 or later, where this vulnerability has been patched.