EUVD-2026-89606
GHSA-jcgm-7m3g-h3cx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Tool-invocation access gives PR:L, low-complexity metacharacter injection gives AC:L, and shell RCE on the host yields C/I/A:H with scope unchanged (S:U); AV:N assumes a network-reachable MCP endpoint.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
8DescriptionCVE.org
A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing a manipulation of the argument url can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 0.11.8 is able to address this issue. This patch is called 360867034e79175b45c8e04a98e4ca712bbaca35. Upgrading the affected component is advised.
AnalysisAI
OS command injection in zosmaai's pi-llm-wiki through 0.11.7 lets an attacker who can invoke the wiki_capture_source MCP tool run arbitrary operating-system commands on the host by manipulating the tool's url argument, which is passed unsanitized into a shell command used for source extraction. Publicly available exploit code exists (referenced in the project's issue tracker), and the flaw is fixed in version 0.11.8; there is no indication of confirmed active exploitation in CISA KEV. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the ability to invoke the wiki_capture_source MCP tool (defined in mcp/index.ts) and control its url argument, which flows into the markitdown source path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine OS command injection (CWE-78) with real substance behind the high score, but the deployment footprint sharply limits real-world impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to pi-llm-wiki 0.11.8, which is the vendor-released patch for this issue (release tag v0.11.8, PR #186, commit 360867034e79175b45c8e04a98e4ca712bbaca35); the fix removes the `sh -c` invocation in extractWithMarkItDown and in the uvx capability probe, so shell metacharacters in the url argument are no longer interpreted. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of zosmaai pi-llm-wiki versions 0.11.7 and earlier and apply the vendor-released patch to version 0.11.8 immediately; if immediate patching is impossible, restrict access to the wiki_capture_source MCP tool to trusted users only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in TypeScript
View allJoplin Server instances prior to 3.7.2 expose an SSO login-code redemption endpoint (GET /api/login_with_code/:id) that
Cross-tenant authorization bypass in TinaCMS self-hosted deployments allows any holder of a legitimate TinaCloud account
Authenticated clients on deepstream.io 10.1.0 can bypass record-write authorization and modify arbitrary protected recor
Path traversal in decap-server's local proxy containment guard allows an unauthenticated attacker to read, write, or del
A remote, unauthenticated denial-of-service condition in the NestJS (Nest) microservices framework lets an attacker cras
Fee-sponsoring servers built on mppx before 0.8.2 can be induced by any client with access to the sponsorship endpoint t
Code escaping sandbox in the PraisonAI npm package's built-in codeMode tool (praisonai 1.4.0 through 1.7.1) lets anyone
Unauthenticated passkey enrollment in OpenReception appointment-booking software prior to 1.1.1 lets remote attackers in
A credential-isolation flaw in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker who controls or can pred
Remote code execution affects Univer v1.0.0-alpha.2 through its Uniscript feature: the UniscriptExecutionService.execute
Dokploy instances running versions prior to 0.29.13 disclose stored Git provider secrets - GitHub App private keys, OAut
Unauthenticated access to the AgentOS HTTP server shipped in the npm `praisonai` package (versions 1.6.0 through 1.7.1)
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today