Critical severity9.9OSV Advisory· Published Jan 10, 2026· Updated Jun 17, 2026
CVE-2026-22688
CVE-2026-22688
Description
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, there is a command injection vulnerability that allows authenticated users to inject stdio_config.command/args into MCP stdio settings, causing the server to execute subprocesses using these injected values. This issue has been patched in version 0.2.5.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/Tencent/WeKnoraGo | < 0.2.5 | 0.2.5 |
Affected products
5- ghsa-coords3 versionspkg:golang/github.com/tencent/weknorapkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
< 0.2.5+ 2 more
- (no CPE)range: < 0.2.5
- (no CPE)range: < 0.0.20260114T191543-150000.1.137.1
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
5- github.com/Tencent/WeKnora/commit/f7900a5e9a18c99d25cec9589ead9e4e59ce04bbnvdPatchWEB
- github.com/Tencent/WeKnora/security/advisories/GHSA-78h3-63c4-5fqcnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-78h3-63c4-5fqcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-22688ghsaADVISORY
- pkg.go.dev/vuln/GO-2026-4292ghsaWEB
News mentions
0No linked articles in our index yet.