VulnSocial

CVE-2026-86540Disclosure

LOWCVSS 8.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-08); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-08: 1Mentions · 2026-09-11: 1Patch / Workaround · 2026-09-11: 1Technical Details · 2026-09-08: 1Technical Details · 2026-09-11: 109-0809-11
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets1 URL
By indicator
Classification over time
DateTotalLabels
2026-09-081
Disclosure1
2026-09-111
Patch1
Full discourse2 posts
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH: CVE-2026-86540 (CVSS 7.8) knowns <0[.]30[.]0 executes arbitrary binaries via unvalidated LSP config fields. Malicious [.]knowns/config[.]json triggers code execution on repo open. Patch to v0[.]30[.]0 now. #CVE #Vulnerability #PatchNow https://t.co/c3NHB88qJW

    Post summary

    The post highlights CVE-2026-86540 (CVSS 7.8) that allows arbitrary binary execution through LSP config fields and directs readers to apply the patch to version 0.30.0.

    0000047
    130 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-86540 knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binarie… https://www.cve.org/CVERecord?id=CVE-2026-86540

    Post summary

    The text announces a validation flaw in project configuration files that could lead to arbitrary binary execution, but it lacks details on PoC, exploit, or remediation.

    000001.3K
    58.1K followersView on X

Explore more

Back to dashboard