# CVE-2026-88937

## Summary

- **CVE ID:** CVE-2026-88937
- **Severity:** HIGH
- **CVSS Score:** 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
- **CWE:** CWE-22
- **Published:** Sep 10, 2026
- **Last Modified:** Sep 10, 2026

## Description

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside the project root. Attackers can supply malicious templates that traverse directories to overwrite shell profiles, steal credentials, or achieve persistent code execution on victim systems.

## Affected Products

- knowns-dev — knowns (0)

## References

- [CNA](https://github.com/knowns-dev/knowns/security/advisories/GHSA-68cq-4rwm-f7jr)
- [CNA](https://github.com/knowns-dev/knowns/security/advisories/GHSA-xjcg-5j3r-m6f9)
- [CNA](https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/codegen/template_engine.go#L625-L636)
- [CNA](https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/codegen/template_engine.go#L318-L344)
- [CNA](https://www.vulncheck.com/advisories/knowns-through-0.33.0-path-traversal-via-template-engine)

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._