Live › vulnerability › CVE-2026-120325
Knip, a dead-code finder for JavaScript and TypeScript projects, has a path traversal flaw in its IssueFixer writeFile function when handling the workspaces argument. A remote attacker can use crafted workspace paths to write files outside the intended directory, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 03:31 UTC. All times on this page are UTC.
Projects that run Knip up to version 6.44.0, including in CI pipelines, where the workspaces argument can be influenced from outside. The sources do not say whether Knip run on trusted local input only is exposed. Teams that do not run Knip, or run only trusted configurations, can likely deprioritise it.
No product ranges from the sources yet.
npx knip --version or npm ls knip in each projectknip to find every place it runsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in Webpro-nl Knip up to 6.44.0. The impacted element is the function writeFile of the file packages/knip/src/IssueFixer.ts of the component Workspace Handler. Such manipulation of the argument workspaces leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-120325")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.