Weknora
CVE-2026-30861
CRITICAL
GHSA-r55h-3rwj-hcmg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister account via unrestricted registration
-
ExploitCraft MCP stdio config with -p flag
-
ExecutionBypass npx whitelist validation
-
ImpactExecute arbitrary code via node command injection
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | WeKnora versions 0.2.5 to 0.2.9 with unrestricted user registration enabled and MCP stdio configuration accessible. Attacker must create account and access configuration validation endpoint that processes npx/uvx commands without proper -p flag sanitization. |
| Impact | CVSS 9.9, PoC available. Combined with SQLi (CVE-2026-30860), provides multiple paths to complete system compromise. |
| Exploit ScenarioDerived | Authenticated user injects OS commands through document processing features, gains shell access, exfiltrates sensitive documents and LLM configuration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
OS command injection in WeKnora from version 0.2.5 allows authenticated users to execute arbitrary system commands. CVSS 9.9 with scope change. PoC available.
Earlier versions of this analysis (1)
Command injection RCE in WeKnora LLM framework.
RemediationAI
Update WeKnora. Sanitize all user inputs before system command execution.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 OS command injection from v0.2.5. Authenticated users can inject system commands through the document processing pipeline.
Know when Weknora gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. From version 0.2.5 to before version 0.2.10, an unauthenticated remote code execution (RCE) vulnerability exists in the MCP stdio configuration validation. The application allows unrestricted user registration, meaning any attacker can create an account and exploit the command injection flaw. Despite implementing a whitelist for allowed commands (npx, uvx) and blacklists for dangerous arguments and environment variables, the validation can be bypassed using the -p flag with npx node. This allows any attacker to execute arbitrary commands with the application's privileges, leading to complete system compromise. This issue has been patched in version 0.2.10.
Executive ViewAI
A critical unauthenticated remote code execution vulnerability (CVSS 9.9) affects WeKnora LLM framework versions 0.2.5 through 0.2.9, allowing attackers to execute arbitrary code without authentication. Any organization running affected versions faces immediate risk of system compromise, data theft, and operational disruption, with active public exploits already available.
Network segmentation restricting access to WeKnora instances; Web Application Firewall (WAF) rules to block malicious MCP stdio configuration payloads; disable MCP stdio protocol support if business operations permit; implement strict input validation at application level; deploy intrusion detection signatures for CVE-2026-30861 exploitation attempts; restrict outbound connections from WeKnora instances to prevent command-and-control callbacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in WeKnora Authorization and Code Execution Flaws
View all 7WeKnora LLM framework (before 0.2.5) allows authenticated users to inject MCP stdio commands that the server executes as
WeKnora's document import feature is vulnerable to Server-Side Request Forgery through HTTP redirects, allowing unauthen
WeKnora versions before 0.2.5 allow unauthenticated attackers to bypass database query restrictions through prompt injec
A security flaw has been discovered in Tencent WeKnora 0.1.0. Rated medium severity (CVSS 6.9), this vulnerability is re
WeKnora's URL-based document ingestion endpoint (POST /api/v1/knowledge-bases/:id/knowledge/url) allows authenticated us
SQL injection in Tencent WeKnora through version 0.8.1 allows an authenticated, low-privileged remote attacker to bypass
Authorization bypass in Tencent WeKnora's Config API endpoint allows authenticated attackers to access unauthorized know
Server-side request forgery guard bypass in WeKnora: the isRestrictedIP()/ipclass address classifier treats NAT64-encode
Exploit-DB