CVE-2026-108821
Tencent WeKnora SQL Validator inject.go validateSubquery sql injection
Tencent WeKnora
CVSS
5.3MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 13 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
A security vulnerability has been detected in Tencent WeKnora up to 0.8.1. Impacted is the function validateSubquery of the file internal/utils/inject.go of the component SQL Validator. The manipulation leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.8.2 is recommended to address this issue. The identifier of the patch is d7ccd5ba517cc3968e6d5000a2ab0f4b51ef1dda. It is recommended to upgrade the affected component.
Text from CVE List
Affected versions 3
- WeKnoraaffected: 0.8.0CVE List
- WeKnoraaffected: 0.8.1CVE List
- WeKnoraunaffected: 0.8.2CVE List
References 10
- github.com/Tencent/WeKnora/pull/3305Fixvia CVE List
- github.com/Tencent/WeKnora/commit/d7ccd5ba517cc3968e6d5000a2ab0f4b51ef1ddaFixvia CVE List
- github.com/Tencent/WeKnora/releases/tag/v0.8.2Fixvia CVE List
- vuldb.com/cve/CVE-2026-108821Advisoryvia CVE List
- vuldb.com/submit/964272Advisoryvia CVE List
- gist.github.com/k4z01/8ab2f57b015825f8738ed536dd870877Exploitvia CVE List
- vuldb.com/vuln/416598Referencevia CVE List
- vuldb.com/vuln/416598/ctiReferencevia CVE List
- github.com/k4z01/WeKnora-SQL-Validation-Bypass/blob/main/weknora-sql-validation-bypass.mdReferencevia CVE List
- github.com/Tencent/WeKnora/Referencevia CVE List