Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, there is a command injection vulnerability that allows authenticated users to inject stdio_config.command/args into MCP stdio settings, causing the server to execute subprocesses using these injected values. This issue has been patched in version 0.2.5.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔴 WeKnora, Command Injection, #CVE-2026-22688 (Critical) https://dailycve.com/weknora-command-injection-cve-2026-22688-critical/
Post summary
The text announces a critical command‑injection vulnerability (CVE‑2026‑22688) in WeKnora, providing only the vulnerability type and severity but no exploits, mitigation, or proof‑of‑concept details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | tencent | weknora | - | - | - |