PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-108821 Tencent CVE debrief

A security vulnerability has been detected in Tencent WeKnora up to 0.8.1. The function validateSubquery of the file internal/utils/inject.go of the component SQL Validator is impacted, leading to sql injection. The attack is possible to be carried out remotely. Upgrading to version 0.8.2 is recommended to address this issue. This sql injection vulnerability in Tencent WeKnora's SQL Validator component allows remote attackers to inject malicious SQL code, potentially leading to unauthorized data access or modification.

Vendor
Tencent
Product
WeKnora
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-12
Original CVE updated
2026-10-12
Advisory published
2026-10-12
Advisory updated
2026-10-12

Who should care

Defenders responsible for Tencent WeKnora deployments should assess exposure and prioritize upgrading to version 0.8.2. Defenders should verify the SQL Validator component for potential vulnerabilities and review the component for potential vulnerabilities. This sql injection vulnerability in Tencent WeKnora's SQL Validator component allows remote attackers to inject malicious SQL code, potentially leading to unauthorized data access or modification.

Why it matters

This sql injection vulnerability in Tencent WeKnora's SQL Validator component allows remote attackers to inject malicious SQL code, potentially leading to unauthorized data access or modification. Defenders should prioritize upgrading to version 0.8.2 and review the component for potential vulnerabilities.

  • Remote attackers may exploit this vulnerability to inject malicious SQL code.
  • Successful exploitation could lead to unauthorized data access or modification.
  • Defenders should verify the SQL Validator component for potential vulnerabilities.
  • Remediation priority is high for deployments using affected versions.

Technical summary

The function validateSubquery of the file internal/utils/inject.go of the component SQL Validator in Tencent WeKnora up to 0.8.1 is vulnerable to sql injection, allowing remote attacks. This vulnerability allows remote attackers to inject malicious SQL code, potentially leading to unauthorized data access or modification. Defenders should prioritize upgrading to version 0.8.2 and review the SQL Validator component for potential vulnerabilities. The vulnerability has been disclosed publicly and may be used. There is no information on whether the vulnerability has been exploited in the wild.

Defensive priority

Defenders should prioritize upgrading to version 0.8.2 and review the SQL Validator component for potential vulnerabilities.

Recommended defensive actions

  • Upgrade to version 0.8.2
  • Review the SQL Validator component for potential vulnerabilities
  • Monitor for potential remote attacks
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its impact and recommended remediation. The vulnerability has been disclosed publicly and may be used. Defenders should verify the SQL Validator component for potential vulnerabilities and review the component for potential vulnerabilities. The CVE record was published on 2026-10-12T09:45:14.947Z and has not been modified since then. There is no information on whether the vulnerability has been exploited in the wild.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-108821 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-108821

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-108821 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-108821

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Tencent WeKnora SQL Validator inject.go validateSubquery sql injection

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108821.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/416598

    Supplemental source - vdb-entry, technical-description

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/416598/cti

    Supplemental source - signature, permissions-required

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/cve/CVE-2026-108821

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/submit/964272

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://gist.github.com/k4z01/8ab2f57b015825f8738ed536dd870877

    Supplemental source - exploit

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Tencent/WeKnora/pull/3305

    Supplemental source - issue-tracking, patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Tencent/WeKnora/commit/d7ccd5ba517cc3968e6d5000a2ab0f4b51ef1dda

    Supplemental source - patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.