https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 16:06:35 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-274992 EUVD-2026-274992 https://cve.radiocsirt.org/vuln/euvd-2026-274992 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30856 <p>WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a vulnerability involving tool name collision and indirect prompt injection allows a malicious remote MCP server to hijack tool execution. By exploiting an ambiguous naming convention in the MCP client (mcp_{service}_{tool}), an attacker can register a malicious tool that overwrites a legitimate one (e.g., tavily_extract). This enables the attacker to redirect LLM execution flow, exfiltrate system prompts, context, and potentially execute other tools with the user&#39;s privileges. This issue has been patched in version 0.3.0.</p> <p>WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a vulnerability involving tool name collision and indirect prompt injection allows a malicious remote MCP server to hijack tool execution. By exploiting an ambiguous naming convention in the MCP client (mcp_{service}_{tool}), an attacker can register a malicious tool that overwrites a legitimate one (e.g., tavily_extract). This enables the attacker to redirect LLM execution flow, exfiltrate system prompts, context, and potentially execute other tools with the user&#39;s privileges. This issue has been patched in version 0.3.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-30856 https://cve.radiocsirt.org/vuln/ghsa-67q9-58vj-32qx <p><strong>Affected:</strong> Go: github.com/Tencent/WeKnora</p> <p>### Summary</p> <p>A vulnerability involving tool name collision and indirect prompt injection allows a malicious remote MCP server to hijack tool execution. By exploiting an ambiguous naming convention in the MCP client (`mcp_{service}_{tool}`), an attacker can register a malicious tool that overwrites a legitimate one (e.g., `tavily_extract`). This enables the attacker to redirect LLM execution flow, exfiltrate system prompts, context, and potentially execute other tools with the user&#39;s privileges.</p> <p>### Details The vulnerability stems from two issues in the WeKnora client&#39;s MCP implementation:</p> <p>1. **Tool Name Collision (Ambiguous Sanitization)**: The client generates internal tool identifiers by sanitizing and joining the service name and tool name with underscores: `mcp_{service}_{tool}`. - Reference: `internal/agent/tools/mcp_tool.go` ```go func (t *MCPTool) Name() string { serviceName := sanitizeName(t.service.Name) toolName := sanitizeName(t.mcpTool.Name) return fmt.Sprintf(&#34;mcp_%s_%s&#34;, serviceName, toolName) } ``` - The registry overwrites existing entries (`internal/agent/tools/registry.go`), so if a malicious service registers a tool that resolves to an existing name, it silently replaces the legitimate implementation ```go // internal/agent/tools/registry.go func (r *ToolRegistry) RegisterTool(tool types.Tool) { r.tools[tool.Name()] = tool } ```</p> <p>2. **Unsanitized Tool/Metadata Output (Indir…</p> <p><strong>Affected:</strong> Go: github.com/Tencent/WeKnora</p> <p>### Summary</p> <p>A vulnerability involving tool name collision and indirect prompt injection allows a malicious remote MCP server to hijack tool execution. By exploiting an ambiguous naming convention in the MCP client (`mcp_{service}_{tool}`), an attacker can register a malicious tool that overwrites a legitimate one (e.g., `tavily_extract`). This enables the attacker to redirect LLM execution flow, exfiltrate system prompts, context, and potentially execute other tools with the user&#39;s privileges.</p> <p>### Details The vulnerability stems from two issues in the WeKnora client&#39;s MCP implementation:</p> <p>1. **Tool Name Collision (Ambiguous Sanitization)**: The client generates internal tool identifiers by sanitizing and joining the service name and tool name with underscores: `mcp_{service}_{tool}`. - Reference: `internal/agent/tools/mcp_tool.go` ```go func (t *MCPTool) Name() string { serviceName := sanitizeName(t.service.Name) toolName := sanitizeName(t.mcpTool.Name) return fmt.Sprintf(&#34;mcp_%s_%s&#34;, serviceName, toolName) } ``` - The registry overwrites existing entries (`internal/agent/tools/registry.go`), so if a malicious service registers a tool that resolves to an existing name, it silently replaces the legitimate implementation ```go // internal/agent/tools/registry.go func (r *ToolRegistry) RegisterTool(tool types.Tool) { r.tools[tool.Name()] = tool } ```</p> <p>2. **Unsanitized Tool/Metadata Output (Indir…</p> https://cve.radiocsirt.org/vuln/ghsa-67q9-58vj-32qx