GHSA-67q9-58vj-32qx: WeKnora Vulnerable to Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection

Summary

WeKnora's MCP client builds internal tool names as `mcp_{service}_{tool}` after sanitizing each part, and its registry (`internal/agent/tools/registry.go`) silently overwrites existing entries. A malicious remote MCP server can register a tool such as `tavily_extract` that replaces the legitimate one, and the client also feeds MCP tool descriptions and results into the LLM context without sanitization. The source states that this lets an attacker redirect LLM execution, exfiltrate system prompts and context, and potentially run other tools with the user's privileges, with a precondition that the user registers the malicious service before the legitimate one.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Model Context Protocol
• Prompt injection and jailbreaks

Related items

• MediumResearchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak ToolkitSimilar attack · The Hacker News
• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• HighCVE-2026-118627: MLflow SHAP load_explainer untrusted deserialization enables code executionSimilar attack · NVD/CVE Database
• HighCVE-2026-118623: MLflow PickleEvaluationArtifact remote code execution via untrusted pickleSimilar attack · NVD/CVE Database