github.com
https://github.com/Tencent/WeKnora CVE-2026-22687
MEDIUM
WeKnora vulnerable to SQL Injection
Record summary
CVE-2026-22687 has a selected CVSS score of 5.6 (medium).
Description
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, after WeKnora enables the Agent service, it allows users to call the database query tool. Due to insufficient backend validation, an attacker can use prompt‑based bypass techniques to evade query restrictions and obtain sensitive information from the target server and database. This issue has been patched in version 0.2.5.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 10, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
WeKnoraBrowse Tencent / WeKnora | CVE List | < 0.2.5 | affected |
github.com/Tencent/WeKnoraBrowse Go / github.com/Tencent/WeKnora | GitHub Advisory | Before 0.2.5 · Fixed in 0.2.5 | affected |
References
5github.com
https://github.com/Tencent/WeKnora/commit/da55707022c252dd2c20f8e18145b2d899ee06a1 github.comConfirmation
https://github.com/Tencent/WeKnora/security/advisories/GHSA-pcwc-3fw3-8cqv nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-22687 pkg.go.dev
https://pkg.go.dev/vuln/GO-2026-4293