Remote Code Execution Vulnerability in WeKnora Framework by Tencent
CVE-2026-30861

10CRITICAL

Key Information:

Vendor

Tencent

Status
Weknora
Vendor
CVE Published:
7 March 2026

What is CVE-2026-30861?

WeKnora, a framework leveraging LLM technology for deep document understanding and semantic retrieval, is vulnerable to an unauthenticated remote code execution (RCE) flaw. This vulnerability, present in versions 0.2.5 to 0.2.9, stems from inadequate MCP stdio configuration validation. It allows unauthorized users to register accounts, which can be exploited to perform command injection, bypassing the implemented whitelists and blacklists of commands and arguments. By using the -p flag with npx node, attackers can execute arbitrary commands with the privileges of the application, posing a severe risk to system integrity. The issue has been addressed in version 0.2.10.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

WeKnora >= 0.2.5, < 0.2.10

References

https://github.com/Tencent/WeKnora/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.