WeKnora has Command Injection in MCP stdio test
CVE-2026-22688 has a selected CVSS score of 10.0 (critical); EIP currently links 1 lab environment.
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, there is a command injection vulnerability that allows authenticated users to inject stdio_config.command/args into MCP stdio settings, causing the server to execute subprocesses using these injected values. This issue has been patched in version 0.2.5.
CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 12, 2026 · Source: CVE List
| Product | Source | Version range | Status |
|---|---|---|---|
WeKnoraBrowse Tencent / WeKnora | CVE List | < 0.2.5 | affected |
github.com/Tencent/WeKnoraBrowse Go / github.com/Tencent/WeKnora | GitHub Advisory | Before 0.2.5 · Fixed in 0.2.5 | affected |
A single Dockerfile builds a Rust binary (mcp-armor) from source and packages it into a distroless OCI image. The image runs a read-only MCP control-plane server by default, or can be used as a wrapping sidecar for MCP servers. The repository includes extensive documentation, a curated CVE feed, and integration tests, consistent with a vulnerability-research and defense tool.
Dockerfile:1-28README.md:1-382The environment is a security sidecar (mcp-armor) designed to scan MCP traffic for prompt injection, verify manifests, and detect tool poisoning. It includes a curated CVE feed, integration tests for specific CVEs, and a control plane for inspection. The Dockerfile builds the tool from source, and the README describes it as a 'drop-in Rust sidecar that armors any MCP server', explicitly targeting vulnerability classes like CVE-2026-42559 and OWASP MCP03.
README.md:1-382Dockerfile:1-28cve-feed/curated-2026-07-03.toml:1-213A Rust binary that wraps MCP servers, scans tool calls for prompt injection, verifies Ed25519 manifest signatures, and exposes a read-only control plane with 11 tools. Built from source in the Dockerfile.
Dockerfile:1-28README.md:1-382A TOML file containing 16 CVE entries with simulate_payload and expected_pattern_id fields, used by the scanner to detect known attack patterns. Compiled into the binary at build time.
cve-feed/curated-2026-07-03.toml:1-213src/cve/feed.rs:1-164A suite of Rust integration tests that exercise the scanner, control plane, drift detection, and tool poisoning detection against known payloads and CVE simulations.
tests/cve_simulation.rs:1-49tests/integration_tool_poison_v08.rs:1-245Multi-stage Dockerfile that compiles the Rust project in a 'rust:bookworm' builder stage and copies the release binary into a 'gcr.io/distroless/cc-debian12:nonroot' image. Sets default command to 'mcp-control'.
Dockerfile:1-28Supported by supplied evidence
The CVE feed includes an entry for CVE-2025-49596 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.
cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49Supported by supplied evidence
The CVE feed includes an entry for CVE-2025-65720 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.
cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49Supported by supplied evidence
The CVE feed includes an entry for CVE-2026-22252 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.
cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49Supported by supplied evidence
The CVE feed includes an entry for CVE-2026-22688 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.
cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49Supported by supplied evidence
The CVE feed includes an entry for CVE-2026-27124 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.
cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49Supported by supplied evidence
The CVE feed includes an entry for CVE-2026-29774 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload. Additionally, dedicated integration tests verify tool-name collision detection for this CVE.
cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49tests/integration_tool_name_collision_v07.rs:1-126Supported by supplied evidence
The CVE feed includes an entry for CVE-2026-30615 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.
cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49Supported by supplied evidence
The CVE feed includes an entry for CVE-2026-30623 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.
cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49Supported by supplied evidence
The CVE feed includes an entry for CVE-2026-30888 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.
cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49Supported by supplied evidence
The CVE feed includes an entry for CVE-2026-31955 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.
cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49Insufficient evidence
CVE-2026-34742 is mentioned in the CHANGELOG and README as a related Go MCP SDK DNS rebinding issue, but it is not present in the curated CVE feed (cve-feed/curated-2026-07-03.toml) and no simulate_payload or scanner pattern is defined for it. The evidence does not show that the lab exercises this CVE.
CHANGELOG.md:1-1459cve-feed/curated-2026-07-03.toml:1-213Supported by supplied evidence
The CVE feed includes an entry for CVE-2026-40576 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.
cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49Supported by supplied evidence
The CVE feed includes an entry for CVE-2026-42282 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload.
cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49Supported by supplied evidence
The CVE feed includes an entry for CVE-2026-42559 with a simulate_payload and expected_pattern_id, and the cve_simulation test asserts that the scanner blocks this payload. The CHANGELOG and README also discuss the transitive closure of this CVE via the rmcp dependency upgrade.
cve-feed/curated-2026-07-03.toml:1-213tests/cve_simulation.rs:1-49CHANGELOG.md:1-1459Dockerfile:1-28Dockerfile:1-28README.md:1-382Dockerfile:1-28Dockerfile:1-28README.md:1-382The Dockerfile builds a Rust project from source and runs it as a non-root user in a distroless image. The default command starts a read-only control plane. There is no evidence of hidden network connections, host filesystem mounts, privilege escalation, or destructive behavior. The tool is designed to scan and block malicious MCP traffic, which is expected behavior for a vulnerability lab.
Dockerfile:1-28README.md:1-382This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.
Packet coverage: some source evidence omitted