Executive brief
WeKnora has Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation in github.com/Tencent/WeKnora
Affected products
- Go github.com/Tencent/WeKnora
Junglewise Threat Intelligence
CVE-2026-30861: GO-2026-4645 - WeKnora has Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation in github.com/Tencent/WeKnora
CVE-2026-30861 · Severity: low · CVSS 3.1 · Published 2026-03-10
Technologies: github.com/Tencent/WeKnora (Go). Vendors: Go.
Related threats
- GO-2026-4640 - WeKnora has Unauthorized Cross‑Tenant Knowledge Base Cloning in github.com/Tencent/WeKnora
- GO-2026-4643 - WeKnora has DNS Rebinding Vulnerability in web_fetch Tool that Allows SSRF to Internal Resources in github.com/Tencent/WeKnora
- GO-2026-4628 - WeKnora is Vulnerable to SSRF via Redirection in github.com/Tencent/WeKnora
- GO-2026-4641 - WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool in github.com/Tencent/WeKnora
- GO-2026-4642 - WeKnora Vulnerable to Broken Access Control in Tenant Management in github.com/Tencent/WeKnora