Tracking: CVE-2026-102911
Severity: Critical (CVSS 3.1: 9.9)
Who is affected
pi-llm-wiki through 0.11.7. The attacker needs control of the URL passed to the wiki_capture_source MCP tool.
How the attack works
The vulnerable path in mcp/index.ts handles a capture URL without safely separating it from command syntax. A malicious value can escape its intended role as a source address and cause commands to run on the wiki host.
Those commands have the MCP process's privileges. Exposure therefore depends on which files, repository credentials, and network services that process can reach.
What to do
- Upgrade to 0.11.8 or later and restart the MCP process. The CVE record identifies fix commit
360867034e79175b45c8e04a98e4ca712bbaca35. - Review capture requests containing unexpected shell syntax, unusual schemes, or destinations unrelated to intended sources.
- Keep the tool's runtime account and mounted directories limited. Investigate unexpected child processes before deciding whether credential rotation is needed.
Scope and limits
The published proof of concept demonstrates exploitability. It does not, by itself, show that your deployment was attacked.