Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-30860 is a critical-severity SQL Injection (CWE-89) vulnerability in Tencent Weknora. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as LLM Application Platforms; in the Other ATLAS/OWASP Terms risk domain.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-30860 is a remote code execution (RCE) vulnerability in WeKnora, an LLM-powered framework for deep document understanding and semantic retrieval. The issue affects versions prior to 0.2.12 and resides in the application's database query functionality, which relies on PostgreSQL. The validation system does not recursively inspect child nodes within PostgreSQL array expressions and row expressions, enabling attackers to bypass SQL injection protections (CWE-89). This allows smuggling of dangerous PostgreSQL functions, chained with large object operations and library loading capabilities, resulting in arbitrary code execution on the database server under database user privileges. The vulnerability carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
An attacker with low privileges required (per CVSS) can exploit this vulnerability remotely over the network with low complexity and no user interaction. Although described as exploitable by unauthenticated attackers, the scenario involves crafting malicious inputs to the database query endpoint that evade validation, smuggling payloads within array or row expressions. Successful exploitation grants RCE on the PostgreSQL database server, executing arbitrary code with the privileges of the database user running the WeKnora application.
The GitHub Security Advisory (GHSA-8w32-6mrw-q5wv) at https://github.com/Tencent/WeKnora/security/advisories/GHSA-8w32-6mrw-q5wv confirms the issue and states it has been patched in WeKnora version 0.2.12. Security practitioners should upgrade to version 0.2.12 or later to mitigate the vulnerability.
WeKnora's use of large language models for semantic retrieval highlights its relevance to AI/ML deployments, where document processing pipelines may inadvertently expose high-severity database flaws. No real-world exploitation has been reported in available data.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10183
Vulnerability Data
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, a remote code execution (RCE) vulnerability exists in the application's database query functionality. The validation system fails to recursively inspect child nodes within…
more
PostgreSQL array expressions and row expressions, allowing attackers to bypass SQL injection protections. By smuggling dangerous PostgreSQL functions inside these expressions and chaining them with large object operations and library loading capabilities, an unauthenticated attacker can achieve arbitrary code execution on the database server with database user privileges. This issue has been patched in version 0.2.12.
- CWE(s)
AI Security AnalysisAI
- AI Category
- LLM Application Platforms
- Risk Domain
- Other ATLAS/OWASP Terms
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: llm
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V6.2.5
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover SQLi flaws before deployment but does not stop their introduction.
Input validation directly stops untrusted data from reaching SQL query construction without neutralization.
Secure engineering principles require parameterized queries and input sanitization that structurally eliminate SQLi.
System monitoring can identify attempted SQLi exploitation via anomalous queries after the weakness exists.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly target injection flaws during coding and review so largely prevent CWE-89 introduction, yet the single broad outcome leaves residual risk from incomplete neutralization techniques or missed edge cases.
Training raises developer awareness of SQLi risks and can reduce introduction likelihood (partial) but removes none of the actual coding flaw's risk by itself since technical neutralization is still required.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The same secure-coding and static-analysis activities surface missing neutralization of SQL metacharacters before the system is accepted.
Early warnings and shared best-practice information help organizations apply the latest remediation techniques against SQL-injection vulnerabilities.
Threat-intelligence feeds that surface new SQL-injection campaigns enable rapid updates to query-construction defenses and detection signatures before exploitation occurs.
Secure-coding rules and security testing phases mandate the use of parameterized queries or equivalent escaping, preventing the construction of dynamic SQL statements from untrusted input.
Language-specific secure coding rules, peer review and SAST together prevent the construction of SQL statements from untrusted data without proper parameterization or escaping.