CVE-2026-108821

6.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-74, CWE-89

Impact

Authenticated remote attackers can execute arbitrary SQL queries against the underlying database. A public exploit is already available.

Root cause

Improper input sanitization in the validateSubquery function allows malicious subqueries to bypass the SQL Validator component.

Affected systems

Tencent WeKnora up to 0.8.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Fix & remediation

Upgrade Tencent WeKnora to version 0.8.2 or apply commit d7ccd5ba517cc3968e6d5000a2ab0f4b51ef1dda. No interim mitigation is documented, so patching is required.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A security vulnerability has been detected in Tencent WeKnora up to 0.8.1. Impacted is the function validateSubquery of the file internal/utils/inject.go of the component SQL Validator. The manipulation leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.8.2 is recommended to address this issue. The identifier of the patch is d7ccd5ba517cc3968e6d5000a2ab0f4b51ef1dda. It is recommended to upgrade the affected component.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-108821