Executive brief
WeKnora has Command Injection in MCP stdio test in github.com/Tencent/WeKnora
Affected products
- Go github.com/Tencent/WeKnora
Junglewise Threat Intelligence
CVE-2026-22688: GO-2026-4292 - WeKnora has Command Injection in MCP stdio test in github.com/Tencent/WeKnora
CVE-2026-22688 · Severity: low · CVSS 3.1 · Published 2026-01-12
Technologies: github.com/Tencent/WeKnora (Go). Vendors: Go.
Related threats
- GO-2026-4640 - WeKnora has Unauthorized Cross‑Tenant Knowledge Base Cloning in github.com/Tencent/WeKnora
- GO-2026-4643 - WeKnora has DNS Rebinding Vulnerability in web_fetch Tool that Allows SSRF to Internal Resources in github.com/Tencent/WeKnora
- GO-2026-4645 - WeKnora has Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation in github.com/Tencent/WeKnora
- GO-2026-4628 - WeKnora is Vulnerable to SSRF via Redirection in github.com/Tencent/WeKnora
- GO-2026-4641 - WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool in github.com/Tencent/WeKnora