Vulnerability · Published Sep 30, 2026 · Assigned by VulDB
CVE-2026-102911zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection
Critical 9.9
In plain English
A critical-severity OS command injection in pi-llm-wiki from zosmaai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 78% of all known vulnerabilities).
Official description
A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing a manipulation of the argument url can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 0.11.8 is able to address this issue. This patch is called 360867034e79175b45c8e04a98e4ca712bbaca35. Upgrading the affected component is advised.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| zosmaai | pi-llm-wiki | 0.11.00.11.10.11.20.11.30.11.40.11.50.11.60.11.7 |
Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
References
- VDB-411587 | zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection vdb-entry, technical-description
- VDB-411587 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-102911 | CVE Analysis and Report third-party-advisory
- Submit #953898 | zosmaai pi-llm-wiki 0.11.7 Command Injection third-party-advisory
- https://github.com/zosmaai/pi-llm-wiki/issues/185 exploit, issue-tracking
- https://github.com/zosmaai/pi-llm-wiki/pull/186 issue-tracking, patch
- https://github.com/zosmaai/pi-llm-wiki/commit/360867034e79175b45c8e04a98e4ca712bbaca35 patch
- https://github.com/zosmaai/pi-llm-wiki/releases/tag/v0.11.8 patch
- https://github.com/zosmaai/pi-llm-wiki/ product