CVE-2026-102911

zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection

State: Published
Severity: 9.4 Critical
Published: Sep 30, 2026
Updated: Sep 30, 2026
Reserved: Sep 29, 2026

Description

A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing a manipulation of the argument url can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 0.11.8 is able to address this issue. This patch is called 360867034e79175b45c8e04a98e4ca712bbaca35. Upgrading the affected component is advised.

Scores

CVSS	Score	Vector	Source
4.0	9.4 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P	VulDB
3.1	9.9 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C	VulDB
3.0	9.9 Critical	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C	VulDB
2.0	9.0 High	AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-78 OS Command Injection
CWE-77 Command Injection

Affected Products

Product	Versions
pi-llm-wikizosmaai	0.11.0Affected 0.11.1Affected 0.11.2Affected 0.11.3Affected 0.11.4Affected 0.11.5Affected 0.11.6Affected 0.11.7Affected 0.11.8Not affected

References

VDB-411587 | zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injectionvdb-entrytechnical-description
VDB-411587 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-102911 | CVE Analysis and Reportthird-party-advisory
Submit #953898 | zosmaai pi-llm-wiki 0.11.7 Command Injectionthird-party-advisory
https://github.com/zosmaai/pi-llm-wiki/issues/185exploitissue-tracking
https://github.com/zosmaai/pi-llm-wiki/pull/186issue-trackingpatch
https://github.com/zosmaai/pi-llm-wiki/commit/360867034e79175b45c8e04a98e4ca712bbaca35patch
https://github.com/zosmaai/pi-llm-wiki/releases/tag/v0.11.8patch
https://github.com/zosmaai/pi-llm-wiki/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.