CVE-2026-86540

HighCVSS 7.8/10Last modified Sep 8, 2026

Description

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Sep 7, 2026
Last modified
Sep 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-865418.3knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite CVE-2026-865429.1knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the impoCVE-2026-865439.8knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password requireCVE-2026-865448.1knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-oCVE-2026-865476.2mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytecCVE-2026-86559.8Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial ofCVE-2026-865506.5NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URCVE-2026-865513.3The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the readCVE-2026-865525.4SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife applicCVE-2026-865538.8SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmaCVE-2026-865544.3SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained CVE-2026-865556.2The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. On