CVE-2026-102911
Published:September 30, 2026
Updated:October 13, 2026
A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing a manipulation of the argument url can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 0.11.8 is able to address this issue. This patch is called 360867034e79175b45c8e04a98e4ca712bbaca35. Upgrading the affected component is advised.
Affected Packages
https://github.com/zosmaai/pi-llm-wiki.git (GITHUB):
Affected version(s) >=v0.2.0 <v0.11.8Fix Suggestion:
Update to version v0.11.8@zosmaai/pi-llm-wiki (NPM):
Affected version(s) >=0.2.0 <0.11.8Fix Suggestion:
Update to version 0.11.8Related Resources (11)
Do you need more information?
Contact UsCVSS v4
Base Score:
8.6
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
HIGH
Subsequent System Integrity
HIGH
Subsequent System Availability
HIGH
Exploit Maturity
POC
CVSS v3
Base Score:
9.9
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Exploit Maturity
PROOF-OF-CONCEPT
Weakness Type (CWE)
EPSS
Base Score:
1.78