CVE-2026-108821
mediumA security vulnerability has been detected in Tencent WeKnora up to 0.8.1.
A security vulnerability has been detected in Tencent WeKnora up to 0.8.1. Impacted is the function validateSubquery of the file internal/utils/inject.go of the component SQL Validator. The manipulation leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.8.2 is recommended to address this issue. The identifier of the patch is d7ccd5ba517cc3968e6d5000a2ab0f4b51ef1dda. It is recommended to upgrade the affected component.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://gist.github.com/k4z01/8ab2f57b015825f8738ed536dd870877 cna@vuldb.com
- https://github.com/Tencent/WeKnora/ cna@vuldb.com
- https://github.com/Tencent/WeKnora/commit/d7ccd5ba517cc3968e6d5000a2ab0f4b51ef1dda cna@vuldb.com
- https://github.com/Tencent/WeKnora/pull/3305 cna@vuldb.com
- https://github.com/Tencent/WeKnora/releases/tag/v0.8.2 cna@vuldb.com
- https://github.com/k4z01/WeKnora-SQL-Validation-Bypass/blob/main/weknora-sql-validation-by... cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-108821 cna@vuldb.com
- https://vuldb.com/submit/964272 cna@vuldb.com
- https://vuldb.com/vuln/416598 cna@vuldb.com
- https://vuldb.com/vuln/416598/cti cna@vuldb.com