An unauthenticated user can exploit a command injection flaw in the MCP stdio configuration validation of WeKnora, allowing arbitrary command execution with the service’s privileges and leading to full system compromise. This flaw arises from the framework’s open registration process combined with a flawed whitelist that can be bypassed using the –p flag with npx node. The weakness aligns with CWE‑78: OS Command Injection.

Tencent WeKnora versions 0.2.5 through 0.2.9 are affected. The vulnerability was fixed in version 0.2.10.

The CVSS v3.1 score of 10 denotes critical severity, but the EPSS score of less than 1% indicates that, as of the last assessment, the probability of exploitation is very low. Nevertheless, because the flaw allows unauthenticated registration and command execution, attackers can achieve complete compromise immediately. The vulnerability is not listed in the CISA KEV catalog, yet unpatched systems remain at high risk until updated.