CVE-2026-102911 in pi-llm-wiki
Summary
by MITRE • 09/30/2026
A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing a manipulation of the argument url can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 0.11.8 is able to address this issue. This patch is called 360867034e79175b45c8e04a98e4ca712bbaca35. Upgrading the affected component is advised.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in zosmaai pi-llm-wiki versions up to 0.11.7 represents a critical security flaw within the wiki_capture_source MCP tool, specifically located in an unknown function of the mcp/index.ts file. This issue stems from improper neutralization of special elements used in operating system commands, commonly referred to as OS command injection. The root cause lies in the application's handling of user-supplied input, particularly the url argument passed during execution. When this parameter is processed without adequate sanitization or validation against a strict allowlist of characters and patterns, it allows an attacker to inject arbitrary shell commands into the underlying operating system environment. This type of flaw typically arises when developers concatenate untrusted data directly with command strings rather than using safe APIs that separate code from data, thereby preventing the interpreter from distinguishing between intended instructions and malicious payloads.
The operational impact of this vulnerability is severe due to its potential for remote exploitation. Since the attack can be executed remotely, an adversary does not need physical or local access to the target system. By manipulating the url argument through network requests directed at the affected component, a threat actor can achieve arbitrary code execution on the host machine running the zosmaai pi-llm-wiki application. This level of control effectively compromises the confidentiality, integrity, and availability of the system. Depending on the privileges under which the vulnerable process runs, an attacker could potentially access sensitive data, modify system configurations, install malware, or use the compromised server as a pivot point for further attacks against other systems within the network infrastructure. The fact that public exploits have been published significantly lowers the barrier to entry for attackers, increasing the likelihood of automated scanning and exploitation attempts in the wild.
From a classification perspective, this vulnerability aligns with CWE-78, which covers Improper Neutralization of Special Elements used in an OS Command. It also maps closely to MITRE ATT&CK techniques related to command and script interpretation, where adversaries leverage native system utilities or scripts to execute malicious actions. The remote nature of the exploit places it within the context of initial access or execution phases depending on how the vulnerable endpoint is exposed. Organizations relying on this component must recognize that the risk extends beyond simple data leakage; it poses a direct threat to infrastructure stability and security posture by allowing full system compromise through a single manipulated input field in an API or web service interface.
To mitigate this vulnerability, immediate action is required to upgrade zosmaai pi-llm-wiki to version 0.11.8 or later. The patch associated with commit identifier 360867034e79175b45c8e04a98e4ca712bbaca35 addresses the underlying code flaw by implementing proper input validation and sanitization mechanisms for the url argument within the mcp/index.ts file. This update ensures that special characters are either escaped, removed, or validated against a predefined set of acceptable values before being passed to any operating system command execution functions. In addition to upgrading, administrators should review their deployment configurations to ensure that the application runs with the principle of least privilege, limiting the potential damage even if an exploit were attempted. Network-level controls such as web application firewalls can also provide temporary protection by inspecting incoming requests for patterns indicative of OS command injection payloads until the software update is fully deployed across all affected instances.