Critical Vulnerability in knowns npm Package: Upgrade Now
- Severity
- CRITICAL
- CVSS
- 9.1
- Affected component
- knowns (npm)
- Affected versions
- >= v0.29.1, <= v0.29.1 or >= v0.29.0, <= v0.29.0 or >= v0.28.0, <= v0.28.0 or >= v0.27.1, <= v0.27.1 or >= v0.27.0, <= v0.27.0 or >= v0.23.0, <= v0.23.0 or >= v0.26.0, <= v0.26.0 or >= v0.25.0, <= v0.25.0 or >= v0.24.1, <= v0.24.1 or >= v0.24.0, <= v0.24.0 or >= v0.22.2, <= v0.22.2 or >= v0.22.1, <= v0.22.1 or >= v0.22.0, <= v0.22.0 or >= v0.21.0, <= v0.21.0 or >= v0.20.5, <= v0.20.5 or >= v0.20.4, <= v0.20.4 or >= v0.20.3, <= v0.20.3 or >= v0.20.2, <= v0.20.2 or >= v0.20.1, <= v0.20.1 or >= v0.20.0, <= v0.20.0 or >= v0.19.2, <= v0.19.2 or >= v0.19.1, <= v0.19.1 or >= v0.19.0, <= v0.19.0 or >= v0.18.4, <= v0.18.4 or >= v0.18.3, <= v0.18.3 or >= v0.18.2, <= v0.18.2 or >= v0.18.1, <= v0.18.1 or >= v0.18.0, <= v0.18.0 or >= v0.17.1, <= v0.17.1 or >= v0.17.0, <= v0.17.0 or >= v0.16.3, <= v0.16.3 or >= v0.16.2, <= v0.16.2 or >= v0.16.1, <= v0.16.1 or >= v0.16.0, <= v0.16.0 or >= v0.15.3, <= v0.15.3 or >= v0.15.2, <= v0.15.2 or >= v0.15.1, <= v0.15.1 or >= v0.15.0, <= v0.15.0 or >= v0.12.4, <= v0.12.4 or >= v0.12.3, <= v0.12.3 or >= v0.12.2, <= v0.12.2 or >= v0.12.1, <= v0.12.1 or >= v0.12.0, <= v0.12.0 or >= v0.11.4, <= v0.11.4 or >= v0.11.3, <= v0.11.3 or >= v0.11.2, <= v0.11.2 or >= v0.11.1, <= v0.11.1 or >= v0.11.0, <= v0.11.0 or >= v0.10.6, <= v0.10.6 or >= v0.10.5, <= v0.10.5 or >= v0.10.4, <= v0.10.4 or >= v0.10.3, <= v0.10.3 or >= v0.10.2, <= v0.10.2 or >= v0.10.1, <= v0.10.1 or >= v0.10.0, <= v0.10.0 or >= v0.9.0, <= v0.9.0 or >= v0.8.9, <= v0.8.9 or >= v0.8.8, <= v0.8.8 or >= v0.8.7, <= v0.8.7 or >= v0.8.6, <= v0.8.6 or >= v0.8.5, <= v0.8.5 or >= v0.8.4, <= v0.8.4 or >= v0.8.3, <= v0.8.3 or >= v0.8.2, <= v0.8.2 or >= v0.8.1, <= v0.8.1 or >= v0.8.0, <= v0.8.0 or >= v0.7.0, <= v0.7.0 or >= v0.6.0, <= v0.6.0 or >= v0.5.0, <= v0.5.0 or >= v0.4.0, <= v0.4.0 or >= v0.3.1, <= v0.3.1 or >= v0.3.0, <= v0.3.0 or >= v0.2.1, <= v0.2.1 or >= v0.2.0, <= v0.2.0 or >= v0.1.8, <= v0.1.8 or >= v0.1.7, <= v0.1.7 or >= v0.1.6, <= v0.1.6 or >= v0.1.5, <= v0.1.5 or >= v0.1.4, <= v0.1.4 or >= v0.1.3, <= v0.1.3 or >= v0.1.2, <= v0.1.2 or >= v0.1.1, <= v0.1.1
- Patched version
- Not yet available
The knowns npm package before version 0.30.0 has a critical vulnerability that allows unauthenticated attackers to write files outside the imports directory. Users of affected versions are at risk.
What happened
The knowns npm package before version 0.30.0 fails to validate import names, which allows unauthenticated attackers to write files outside the intended imports directory. Attackers can exploit this by supplying traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files that the server process can write to. This vulnerability has been confirmed by multiple independent sources and is tracked as CVE-2026-86542 with a CVSS score of 9.1.
To assess your exposure, check if your project dependencies include the knowns package in any of the affected version ranges. The affected versions span from 0.1.1 to 0.29.1, inclusive. If your project uses any version within this range, it is vulnerable to this critical flaw.
What to do about it
- Upgrade the knowns package to version 0.30.0 or higher to mitigate the risk of unauthorized file writes.
- Review your project dependencies and ensure that all instances of the knowns package are updated to the patched version.
- Scan your project for any signs of unauthorized file writes that may have occurred prior to the upgrade.
- Monitor the primary sources for any further updates or additional vulnerabilities that may be discovered.
How 0Day would have caught this
knowns is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if your project includes the knowns package in any version from 0.1.1 to 0.29.1, inclusive.
What should I do right now?
Upgrade the knowns package to version 0.30.0 or higher immediately.
Has this vulnerability been exploited in the wild?
No, this vulnerability has not been exploited in the wild according to the threat data.
Is this a supply-chain attack?
No, this is not a supply-chain attack as per the threat data.