CVE-2026-30861

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. From version 0.2.5 to before version 0.2.10, an unauthenticated remote code execution (RCE) vulnerability exists in the MCP stdio configuration validation. The application allows unrestricted user registration, meaning any attacker can create an account and exploit the command injection flaw. Despite implementing a whitelist for allowed commands (npx, uvx) and blacklists for dangerous arguments and environment variables, the validation can be bypassed using the -p flag with npx node. This allows any attacker to execute arbitrary commands with the application's privileges, leading to complete system compromise. This issue has been patched in version 0.2.10.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/Tencent/WeKnora/security/advisories/GHSA-r55h-3rwj-hcmg	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:tencent:weknora:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-07 17:15

Updated : 2026-03-09 17:35

NVD link : CVE-2026-30861

Mitre link : CVE-2026-30861

CVE.ORG link : CVE-2026-30861

JSON object : View

Products Affected

tencent

weknora

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-30861", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2026-03-07T17:15:53.980", "references": [{"url": "https://github.com/Tencent/WeKnora/security/advisories/GHSA-r55h-3rwj-hcmg", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. From version 0.2.5 to before version 0.2.10, an unauthenticated remote code execution (RCE) vulnerability exists in the MCP stdio configuration validation. The application allows unrestricted user registration, meaning any attacker can create an account and exploit the command injection flaw. Despite implementing a whitelist for allowed commands (npx, uvx) and blacklists for dangerous arguments and environment variables, the validation can be bypassed using the -p flag with npx node. This allows any attacker to execute arbitrary commands with the application's privileges, leading to complete system compromise. This issue has been patched in version 0.2.10."}, {"lang": "es", "value": "WeKnora es un framework impulsado por LLM dise\u00f1ado para la comprensi\u00f3n profunda de documentos y la recuperaci\u00f3n sem\u00e1ntica. Desde la versi\u00f3n 0.2.5 hasta antes de la versi\u00f3n 0.2.10, existe una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo (RCE) no autenticada en la validaci\u00f3n de la configuraci\u00f3n stdio de MCP. La aplicaci\u00f3n permite el registro de usuarios sin restricciones, lo que significa que cualquier atacante puede crear una cuenta y explotar la falla de inyecci\u00f3n de comandos. A pesar de implementar una lista blanca para comandos permitidos (npx, uvx) y listas negras para argumentos peligrosos y variables de entorno, la validaci\u00f3n puede ser eludida usando la bandera -p con npx node. Esto permite a cualquier atacante ejecutar comandos arbitrarios con los privilegios de la aplicaci\u00f3n, lo que lleva a un compromiso completo del sistema. Este problema ha sido parcheado en la versi\u00f3n 0.2.10."}], "lastModified": "2026-03-09T17:35:56.647", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tencent:weknora:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13FE8D37-06C9-4406-AE17-C35A7C66CC0C", "versionEndExcluding": "0.2.10", "versionStartIncluding": "0.2.5"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}