A vulnerability exists in Tencent WeKnora up to version 0.8.1 within the validateSubquery function of internal/utils/inject.go. The function fails to properly validate input, allowing an attacker to craft a malicious subquery that is executed by the database. This results in arbitrary SQL code execution, compromising the confidentiality and integrity of data stored by the affected system. The weakness is identified as improper input validation (CWE-74) and SQL injection (CWE-89). The vulnerability can be exploited remotely and has already been publicly disclosed.

All installations of Tencent WeKnora prior to the 0.8.2 release are affected, including version 0.8.1 and earlier builds. The component that validates SQL queries is vulnerable; any deployment that uses the default configuration without applying the patch is potentially exposed.

The CVSS score is 5.3, indicating a medium severity, while the EPSS score is unavailable and the flaw is not listed in the CISA KEV catalog. Attackers require remote access to the WeKnora SQL validator and can send a crafted payload to exploit the weakness. The security patch identified by commit d7ccd5ba517cc3968e6d5000a2ab0f4b51ef1dda resolves the issue, but until it is applied, the risk remains moderate and must be mitigated promptly.