Weknora
CVE-2026-22688
CRITICAL
GHSA-78h3-63c4-5fqc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to WeKnora instance
-
DeliveryAccess MCP stdio configuration settings
-
ExploitInject malicious commands into stdio_config.command/args
-
ExecutionServer executes injected subprocess with elevated privileges
-
ImpactAttacker gains arbitrary code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated user account on WeKnora versions prior to 0.2.5 with access to MCP (Model Context Protocol) stdio configuration parameters. Attacker must have valid credentials to interact with the framework's configuration interface. |
| Impact | CVSS 9.9 (Critical). Low privileges, network vector, low complexity, scope change. PoC available. EPSS 0.34%. Patch available. |
| Exploit ScenarioDerived | An authenticated user configures a custom MCP stdio command pointing to /bin/bash with args executing a reverse shell. WeKnora spawns the subprocess, giving the attacker shell access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
WeKnora LLM framework (before 0.2.5) allows authenticated users to inject MCP stdio commands that the server executes as subprocesses. PoC available, patch available.
Earlier versions of this analysis (1)
WeKnora allows command injection through MCP stdio settings, enabling authenticated RCE via subprocess execution.
RemediationAI
Update to WeKnora 0.2.5. Validate and whitelist allowed MCP commands. Do not allow user-controlled subprocess execution.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Authenticated users can modify MCP stdio_config.command and args values (CWE-77). The server uses these to spawn subprocesses, effectively executing arbitrary commands specified by the user. MCP (Model Context Protocol) servers are a growing attack surface.
Know when Weknora gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, there is a command injection vulnerability that allows authenticated users to inject stdio_config.command/args into MCP stdio settings, causing the server to execute subprocesses using these injected values. This issue has been patched in version 0.2.5.
Executive ViewAI
Organizations using WeKnora face critical risk from CVE-2026-22688, a command injection vulnerability rated CVSS 9.9. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. Proof-of-concept code is publicly available, increasing the risk of exploitation. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Deploy WAF rules to block injection patterns; (2) Restrict network access to affected components; (3) Enable enhanced logging for suspicious activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)GitHub Advisory
OS command injection in WeKnora from version 0.2.5 allows authenticated users to execute arbitrary system commands. CVSS
SQL injection in WeKnora LLM document understanding framework allows authenticated users to extract arbitrary database c
Insufficient authorization checks in WeKnora's tenant management endpoints allow any authenticated user to read, modify,
DNS rebinding in WeKnora's web_fetch tool allows authenticated attackers to bypass URL validation and access internal re
WeKnora's document import feature is vulnerable to Server-Side Request Forgery through HTTP redirects, allowing unauthen
WeKnora versions before 0.2.5 allow unauthenticated attackers to bypass database query restrictions through prompt injec
A security flaw has been discovered in Tencent WeKnora 0.1.0. Rated medium severity (CVSS 6.9), this vulnerability is re
Weknora versions up to 0.3.0 is affected by authorization bypass through user-controlled key (CVSS 5.3).
WeKnora's URL-based document ingestion endpoint (POST /api/v1/knowledge-bases/:id/knowledge/url) allows authenticated us
SQL injection in Tencent WeKnora through version 0.8.1 allows an authenticated, low-privileged remote attacker to bypass
Authorization bypass in Tencent WeKnora's Config API endpoint allows authenticated attackers to access unauthorized know
Server-side request forgery guard bypass in WeKnora: the isRestrictedIP()/ipclass address classifier treats NAT64-encode
Exploit-DB