Command Injection in WeKnora MCP STDIO Service Test Path

Successful exploitation allows an authenticated attacker to achieve server-side remote code execution in the context of the WeKnora service. This can enable execution of arbitrary payloads, creation or modification of files, disclosure of sensitive local data such as environment variables, configuration files, API keys, and other accessible secrets, and may facilitate privilege escalation, persistence, lateral movement, or cross-tenant impact depending on deployment isolation and runtime permissions.

If immediate patching is not possible, restrict access to MCP service creation, update, and especially the /api/v1/mcp-services/{id}/test endpoint to trusted administrators only. Disable or remove STDIO transport in production where it is not strictly required. Enforce strict server-side allowlisting of permitted binaries and arguments, block shell interpreters such as bash and sh and dangerous flags such as -c or -lc, and apply containment controls including network segmentation, least-privilege execution, read-only filesystems where feasible, restricted mounts, and seccomp/AppArmor or equivalent sandboxing to reduce blast radius.

Upgrade WeKnora to version 0.2.5 or later, which patches the vulnerable behavior. Ensure that MCP STDIO command execution paths validate and constrain stdio_config.command and stdio_config.args before both storage and execution, and avoid passing user-controlled command definitions directly to subprocess creation logic.