What happened
Two related access-control failures in the knowns MCP-based agent framework: an unconfined file-path argument on the code.find tool enabling host-wide file disclosure (CVSS 6.5), and a completely unguarded project.set action that lets an attacker escalate a read-only session to write access by repointing the server at an attacker-chosen directory (CVSS 8.3).
Why it matters
Both flaws defeat the intended read-only sandboxing of an AI coding-agent session — exactly the isolation boundary enterprises rely on to safely let agents operate on code — turning a nominally restricted agent into one with arbitrary host file read and write capability.
Attack vector
CVE-2026-88938: the code.find MCP tool's path argument is not confined to the project root, so absolute paths or traversal sequences let an AI agent session read arbitrary files anywhere on the host. CVE-2026-88939: the project.set action is exempted from permission-guard checks entirely, letting a read-only agent session repoint the server at a different project directory and thereby gain write access.
Affected systems
knowns, versions through 0.33.0
Mitigation
Upgrade past knowns v0.33.0 once a patched release is available; in the interim, restrict which directories agent sessions can be pointed at and audit MCP tool path arguments for traversal sequences.