{"data":{"id":"9d43068c-ad6a-42cf-8be9-8ee6f2eb2362","title":"GHSA-67q9-58vj-32qx: WeKnora Vulnerable to Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection","summary":"WeKnora's MCP client builds internal tool names as `mcp_{service}_{tool}` after sanitizing each part, and its registry (`internal/agent/tools/registry.go`) silently overwrites existing entries. A malicious remote MCP server can register a tool such as `tavily_extract` that replaces the legitimate one, and the client also feeds MCP tool descriptions and results into the LLM context without sanitization. The source states that this lets an attacker redirect LLM execution, exfiltrate system prompts and context, and potentially run other tools with the user's privileges, with a precondition that the user registers the malicious service before the legitimate one.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-67q9-58vj-32qx","publishedAt":"2026-03-06T23:54:44.000Z","cveId":"CVE-2026-30856","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["prompt_injection","supply_chain"],"issueType":"vulnerability","affectedPackages":["github.com/Tencent/WeKnora@<= 0.2.14"],"affectedPackageNames":["github.com/tencent/weknora"],"affectedPackageRefs":["go:github.com/tencent/weknora"],"affectedVendors":[],"affectedVendorsRaw":["WeKnora","MCP"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0029,"epssCheckedAt":"2026-11-04T12:08:34.749Z","kevDateAdded":null,"advisoryAliases":["GHSA-67q9-58vj-32qx"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0010","AML.T0051"],"fixes":[]}}