CVE-2026-30861

Estado: AnalizadaAlta (8.8)—

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. From version 0.2.5 to before version 0.2.10, an unauthenticated remote code execution (RCE) vulnerability exists in the MCP stdio configuration validation. The application allows unrestricted user registration, meaning any attacker can create an account and exploit the command injection flaw. Despite implementing a whitelist for allowed commands (npx, uvx) and blacklists for dangerous arguments and environment variables, the validation can be bypassed using the -p flag with npx node. This allows any attacker to execute arbitrary commands with the application's privileges, leading to complete system compromise. This issue has been patched in version 0.2.10.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 8.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 2.56%
Percentil entre todas las CVEs puntuadas: 85
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement75 %
Impacto principalT1059 Command and Scripting Interpreterexecution90 %
Impacto secundarioT1068 Exploitation for Privilege Escalationprivilege escalation70 %

AV:N, PR:L sin UI:R indica explotación remota con privilegios (T1210). CWE-78 permite ejecutar comandos arbitrarios (T1059) ganando privilegios root del servicio (T1068).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence Program Privileged Account Management Execution Prevention Disable or Remove Feature or Program Application Isolation and Sandboxing Exploit Protection

Tecnologías afectadas (1)

Tencent — Weknora

CWE

CWE-78

Referencias

https://github.com/Tencent/WeKnora/security/advisories/GHSA-r55h-3rwj-hcmg

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-30861",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-30861",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-09T17:58:51.217526Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Tencent",
          "product": "WeKnora",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.2.5, < 0.2.10"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-07T17:15:53.980",
  "references": [
    {
      "url": "https://github.com/Tencent/WeKnora/security/advisories/GHSA-r55h-3rwj-hcmg",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. From version 0.2.5 to before version 0.2.10, an unauthenticated remote code execution (RCE) vulnerability exists in the MCP stdio configuration validation. The application allows unrestricted user registration, meaning any attacker can create an account and exploit the command injection flaw. Despite implementing a whitelist for allowed commands (npx, uvx) and blacklists for dangerous arguments and environment variables, the validation can be bypassed using the -p flag with npx node. This allows any attacker to execute arbitrary commands with the application's privileges, leading to complete system compromise. This issue has been patched in version 0.2.10."
    },
    {
      "lang": "es",
      "value": "WeKnora es un framework impulsado por LLM diseñado para la comprensión profunda de documentos y la recuperación semántica. Desde la versión 0.2.5 hasta antes de la versión 0.2.10, existe una vulnerabilidad de ejecución remota de código (RCE) no autenticada en la validación de la configuración stdio de MCP. La aplicación permite el registro de usuarios sin restricciones, lo que significa que cualquier atacante puede crear una cuenta y explotar la falla de inyección de comandos. A pesar de implementar una lista blanca para comandos permitidos (npx, uvx) y listas negras para argumentos peligrosos y variables de entorno, la validación puede ser eludida usando la bandera -p con npx node. Esto permite a cualquier atacante ejecutar comandos arbitrarios con los privilegios de la aplicación, lo que lleva a un compromiso completo del sistema. Este problema ha sido parcheado en la versión 0.2.10."
    }
  ],
  "lastModified": "2026-06-17T10:33:03.130",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tencent:weknora:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13FE8D37-06C9-4406-AE17-C35A7C66CC0C",
              "versionEndExcluding": "0.2.10",
              "versionStartIncluding": "0.2.5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}