CVE-2026-30860 - Vulnerability Analysis

Overview

WeKnora < 0.2.12 contains a SQL injection caused by insufficient validation of child nodes in PostgreSQL array and row expressions, letting unauthenticated attackers execute arbitrary code on the database server with database user privileges.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary code on the database server with database user privileges, risking full database compromise.

Mitigation

Upgrade to version 0.2.12 or later.

References

• https://github.com/Tencent/WeKnora/security/advisories/GHSA-8w32-6mrw-q5wv

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 8, 2026

🔴 CVE-2026-30860 - Critical (9.9) WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, a remote code execution (RCE) vulnerability exists in the application's database query functionality. The validation syst... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30860/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner