TI-2026-23690 Aliases CVE-2026-30861 GHSA-r55h-3rwj-hcmg

WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation

HIGH 76CWE-78Published 2026-03-07 · Updated 2026-03-09

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. From version 0.2.5 to before version 0.2.10, an unauthenticated remote code execution (RCE) vulnerability exists in the MCP stdio configuration validation. The application allows unrestricted user registration, meaning any attacker can create an account and exploit the command injection flaw. Despite implementing a whitelist for allowed commands (npx, uvx) and blacklists for dangerous arguments and environment variables, the validation can be bypassed using the -p flag with npx node. This allows any attacker to execute arbitrary commands with the application's privileges, leading to complete system compromise. This issue has been patched in version 0.2.10.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.02378 83rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed WeKnora (Tencent): 0.2.10github.com/Tencent/WeKnora (Go): 0.2.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Tencent	WeKnora	0.2.5 to before 0.2.10	0.2.10	Patch available	CNA
—	github.com/Tencent/WeKnora (Go)	0.2.5 to before 0.2.10	0.2.10	Patch available	GHSA-r55h-3rwj-hcmg

WeKnora VendorTencent Affected 0.2.5 to before 0.2.10 Fixed in 0.2.10 Patch available CNA
github.com/Tencent/WeKnora (Go) Vendor— Affected 0.2.5 to before 0.2.10 Fixed in 0.2.10 Patch available GHSA-r55h-3rwj-hcmg

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:tencent:weknora::::::::	0.2.5 to before 0.2.10	Vulnerable	Tencent

cpe:2.3:a:tencent:weknora:*:*:*:*:*:*:*:* Versions 0.2.5 to before 0.2.10 Vulnerable ·Tencent

Remediation

Fix · CNA WeKnora (Tencent) Fixed in 0.2.10
Fix · GHSA-r55h-3rwj-hcmg github.com/Tencent/WeKnora (Go) Fixed in 0.2.10 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-30861
2026-10-03 Alias added: GHSA-r55h-3rwj-hcmg

References

Exploit 1

https://github.com/Tencent/WeKnora/security/advisories/GHSA-r55h-3rwj-hcmg

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-30861

Other 2

TI-2026-23689 WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query Tool CVSS 3.1CRITICAL 10.0
TI-2026-18215 WeKnora has Command Injection in MCP stdio test CVSS 3.1CRITICAL 10.0
TI-2026-18214 WeKnora vulnerable to SQL Injection CVSS 3.1CRITICAL 9.8
TI-2026-23684 WeKnora: Broken Access Control in Tenant Management CVSS 3.1HIGH 8.8
TI-2025-10116 Tencent WeKnora test testEmbeddingModel server-side request forgery CVSS 4.0MEDIUM 6.9
TI-2026-23687 WeKnora: DNS Rebinding Vulnerability in web_fetch Tool Allows SSRF to Internal Resources CVSS 3.1HIGH 7.5

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences