knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json

Overview A critical Arbitrary Code Execution ACE vulnerability exists in the Knowns Language Server Protocol LSP detection and startup pipeline. The system blindly trusts the settings.lsp.languages..binary field defined in the project-level .knowns/config.json file. Because this field is never...

GHSA-HRR3-GC8F-F4QJ vulnerabilities

Vulnerabilities for packages: jupyter-base-notebook, opensearch-dashboards, yaml-language-server, vitess, prism...

CVE-2026-86472 vulnerabilities

Vulnerabilities for packages: jupyter-base-notebook, opensearch-dashboards, yaml-language-server, vitess, prism...

[SECURITY] Fedora 43 Update: ty-0.0.84-1.fc43

An extremely fast Python type checker and language server, written in Rust...

CVE-2026-84292 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, prism, unleash-proxy, keep, nextcloud-server, wazuh-dashboard, keep-fips, wazuh-dashboard-fips, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, yaml-language-server, serve, vitess, opensearch-dashboards, jupyter-base-notebook, renovate,...

GHSA-58MR-GQGX-XQ4G vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, prism, unleash-proxy, keep, nextcloud-server, wazuh-dashboard, keep-fips, wazuh-dashboard-fips, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, yaml-language-server, serve, vitess, opensearch-dashboards, renovate, commercial-gitlab-rails-ee,...

CVE-2026-84394 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, prism, unleash-proxy, keep, nextcloud-server, wazuh-dashboard, keep-fips, wazuh-dashboard-fips, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, yaml-language-server, serve, vitess, opensearch-dashboards, renovate, commercial-gitlab-rails-ee,...

GHSA-QW65-CVWX-89V3 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, prism, unleash-proxy, keep, nextcloud-server, wazuh-dashboard, keep-fips, wazuh-dashboard-fips, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, yaml-language-server, serve, vitess, opensearch-dashboards, jupyter-base-notebook, renovate,...

GHSA-QW65-CVWX-89V3 vulnerabilities

Vulnerabilities for packages: jupyter-base-notebook, serve, opensearch-dashboards, yaml-language-server, vitess, renovate, prism...

CVE-2026-84292 vulnerabilities

Vulnerabilities for packages: jupyter-base-notebook, serve, opensearch-dashboards, yaml-language-server, vitess, renovate, prism...

CVE-2026-84394 vulnerabilities

Vulnerabilities for packages: serve, opensearch-dashboards, yaml-language-server, vitess, renovate, prism...

GHSA-58MR-GQGX-XQ4G vulnerabilities

Vulnerabilities for packages: serve, opensearch-dashboards, yaml-language-server, vitess, renovate, prism...

Malicious code in json-language-server (npm)

The package json-language-server was found to contain malicious code. --- Credit: OpenSSF source...

CVE-2026-86540 knowns before 0.30.0 Arbitrary Code Execution via LSP Binary

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binar...

Malicious Package

Overview dbt-language-server is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malware in dbt-language-server

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-48122 Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extension

Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler Gemfile used at startup. A malicious...

CVE-2026-48122

Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler Gemfile used at startup. A malicious...

GHSA-7P8R-X3MC-P8W7 vulnerabilities

Vulnerabilities for packages: nextcloud-server, gitlab-rails-ce, serve, arangodb, opensearch-dashboards-fips, langfuse, saf, argo-workflows, vitess, opensearch-dashboards, jupyter-base-notebook, renovate, commercial-gitlab-rails-ee, unleash-proxy, gitlab-rails-ce-fips, prism, langfuse-fips,...

CVE-2026-18446 vulnerabilities

Vulnerabilities for packages: nextcloud-server, gitlab-rails-ce, serve, arangodb, opensearch-dashboards-fips, langfuse, saf, argo-workflows, vitess, opensearch-dashboards, jupyter-base-notebook, renovate, commercial-gitlab-rails-ee, unleash-proxy, gitlab-rails-ce-fips, prism, langfuse-fips,...