WeKnora, the LLM‑powered document understanding framework, contains a command injection flaw in its MCP stdio configuration. The vulnerability permits an authenticated user to supply arbitrary values for stdio_config.command or args, which the server executes as system subprocesses. This enables an attacker to run any desired code with the privileges of the WeKnora service, granting complete control over the host. The flaw is a classic command injection (CWE‑77) and is quantified with a CVSS score of 10, indicating a deterministic critical impact.

Deployments of Tencent’s WeKnora framework before version 0.2.5 are affected. This includes all installations of Tencent’s WeKnora before 0.2.5.

The EPSS score is below 1%, indicating a low probability of exploitation at this time, but the vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access with rights to modify MCP stdio settings; once authenticated, the attacker can execute arbitrary commands, making the risk for confidentiality, integrity, and availability of the entire service instance extremely high. The severity remains at the maximum level due to the CVSS score of 10, and the official fix has been released in version 0.2.5.