CVE-2026-22688
Critical · 9.9CVSS
9.9
EPSS
1.9%
Published
Jan 10, 2026
CISA due date
—
The record
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, there is a command injection vulnerability that allows authenticated users to inject stdio_config.command/args into MCP stdio settings, causing the server to execute subprocesses using these injected values. This issue has been patched in version 0.2.5.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/Tencent/WeKnora | 0 | 0.2.5 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260114T191543-150000.1.137.1 |
Related vulnerabilities
- GO-2026-4292 WeKnora has Command Injection in MCP stdio test in github.com/Tencent/WeKnora Same vulnerability
- GO-2026-4293 WeKnora vulnerable to SQL Injection in github.com/Tencent/WeKnora Also affects github.com/Tencent/WeKnora
- CVE-2026-22687 WeKnora is an LLM-powered framework designed for deep document understanding and semantic… Also affects github.com/Tencent/WeKnora
- CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
- CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
- CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34042 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34040 Moby is an open source container framework. Also affects govulncheck-vulndb