CVE-2026-102911

A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing a manipulation of the argument url can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 0.11.8 is able to address this issue. This patch is called 360867034e79175b45c8e04a98e4ca712bbaca35. Upgrading the affected component is advised.

• CWE-77
• CWE-78

• https://github.com/zosmaai/pi-llm-wiki/
• https://github.com/zosmaai/pi-llm-wiki/commit/360867034e79175b45c8e04a98e4ca712bbaca35
• https://github.com/zosmaai/pi-llm-wiki/issues/185
• https://github.com/zosmaai/pi-llm-wiki/pull/186
• https://github.com/zosmaai/pi-llm-wiki/releases/tag/v0.11.8
• https://vuldb.com/cve/CVE-2026-102911
• https://vuldb.com/submit/953898
• https://vuldb.com/vuln/411587
• https://vuldb.com/vuln/411587/cti

Published

Sep 30, 2026

Last Modified

Sep 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102905The The Ad Inserter – Ad Manager & AdSense Ads plugin for Wo…6.5
• CVE-2026-102906A vulnerability was identified in 0xshariq github-mcp-server…6.3
• CVE-2026-102908A vulnerability was determined in SourceCodester Online Revi…7.3
• CVE-2026-102909A vulnerability was identified in SourceCodester Online Revi…7.3
• CVE-2026-10291A security vulnerability has been detected in Enderfga claw-…5.3
• CVE-2026-102910A security flaw has been discovered in SourceCodester Online…7.3
• CVE-2026-102912A vulnerability was identified in SourceCodester Online Leav…4.7
• CVE-2026-102913A security flaw has been discovered in SourceCodester Car Dr…7.3
• CVE-2026-102914Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-102915Subscriber Broken Access Control in WPO365 <= 44.1 versions.8.5
• CVE-2026-102916A reachable assertion in the illumos bhyve instruction emula…6.8
• CVE-2026-102917IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticat…7.8