CVE-2026-108821

MediumCVSS 6.3

Published: 12/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

A security vulnerability was detected in Tencent WeKnora up to version 0.8.1 in the validateSubquery function of the file internal/utils/inject.go in the SQL Validator component. The manipulation leads to SQL injection. The attack can be carried out remotely and the exploit has been publicly disclosed.

Risk Assessment

The vulnerability may allow an attacker to manipulate SQL queries, potentially leading to unauthorized data access or corruption.

Recommendation

It is recommended to upgrade to version 0.8.2, which includes the patch identified as d7ccd5ba517cc3968e6d5000a2ab0f4b51ef1dda.

Other vulnerabilities in Tencent WeKnora

CVE-2026-8786Medium
A vulnerability has been found in Tencent WeKnora up to 0.3.6 in the getKnowledgeBaseForInitialization function of internal/handler/initialization.go in the Config API Endpoint component. Manipulation of the kbId argument leads to authorization bypass, and the attack can be initiated remotely. The exploit has been publicly disclosed and the vendor did not respond.

Original NVD description (English source)

A security vulnerability has been detected in Tencent WeKnora up to 0.8.1. Impacted is the function validateSubquery of the file internal/utils/inject.go of the component SQL Validator. The manipulation leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.8.2 is recommended to address this issue. The identifier of the patch is d7ccd5ba517cc3968e6d5000a2ab0f4b51ef1dda. It is recommended to upgrade the affected component.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS