Weknora
CVE-2026-30860
CRITICAL
GHSA-8w32-6mrw-q5wv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious PostgreSQL array expression
-
DeliveryBypass recursive validation in child nodes
-
ExploitSmuggle dangerous functions via row expressions
-
ExecutionChain with large object operations
-
PersistLoad arbitrary library
-
ImpactExecute remote code
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | WeKnora version prior to 0.2.12 with database query functionality exposed; authenticated user account required (PR:L); PostgreSQL backend with large object operations and library loading capabilities enabled. |
| Impact | CVSS 9.9, PoC available. AI/ML frameworks handling documents often contain sensitive business data. |
| Exploit ScenarioDerived | Authenticated user injects SQL through document search query, extracts sensitive documents, user data, or system credentials from the database. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
SQL injection in WeKnora LLM document understanding framework allows authenticated users to extract arbitrary database contents. CVSS 9.9 with scope change. PoC available.
Earlier versions of this analysis (1)
SQL injection in WeKnora LLM-powered document retrieval framework.
RemediationAI
Update WeKnora. Use parameterized queries for all database operations.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-89 SQL injection with scope change. Authenticated users can inject SQL through document queries, accessing data beyond their authorization scope.
Know when Weknora gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, a remote code execution (RCE) vulnerability exists in the application's database query functionality. The validation system fails to recursively inspect child nodes within PostgreSQL array expressions and row expressions, allowing attackers to bypass SQL injection protections. By smuggling dangerous PostgreSQL functions inside these expressions and chaining them with large object operations and library loading capabilities, an unauthenticated attacker can achieve arbitrary code execution on the database server with database user privileges. This issue has been patched in version 0.2.12.
Executive ViewAI
A critical remote code execution vulnerability (CVE-2026-30860) affects WeKnora LLM framework versions prior to 0.2.12, allowing unauthenticated attackers to execute arbitrary code through database query manipulation. Organizations using affected versions face complete system compromise and potential data breach, with active public exploits already available.
Implement network segmentation isolating WeKnora instances; restrict database query API endpoints to authenticated users only via WAF/API gateway; disable or restrict the document processing and semantic retrieval features if operationally feasible; enforce strict input validation and query parameter sanitization; enable comprehensive logging and real-time alerting on database query patterns; consider temporary migration of document processing workloads to alternative systems until patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in WeKnora Authorization and Code Execution Flaws
View all 7WeKnora LLM framework (before 0.2.5) allows authenticated users to inject MCP stdio commands that the server executes as
WeKnora's document import feature is vulnerable to Server-Side Request Forgery through HTTP redirects, allowing unauthen
WeKnora versions before 0.2.5 allow unauthenticated attackers to bypass database query restrictions through prompt injec
A security flaw has been discovered in Tencent WeKnora 0.1.0. Rated medium severity (CVSS 6.9), this vulnerability is re
WeKnora's URL-based document ingestion endpoint (POST /api/v1/knowledge-bases/:id/knowledge/url) allows authenticated us
SQL injection in Tencent WeKnora through version 0.8.1 allows an authenticated, low-privileged remote attacker to bypass
Authorization bypass in Tencent WeKnora's Config API endpoint allows authenticated attackers to access unauthorized know
Server-side request forgery guard bypass in WeKnora: the isRestrictedIP()/ipclass address classifier treats NAT64-encode
Exploit-DB