WeKnora faces a critical unauthenticated remote code execution vulnerability where attackers can bypass SQL injection filters to execute arbitrary code on the database server.

The application's validation system fails to recursively inspect child nodes within PostgreSQL array and row expressions. This allows an unauthenticated attacker to smuggle dangerous functions, such as large object operations, to achieve RCE with the privileges of the database user.

Exploitation of this vulnerability results in full compromise of the database server. Attackers can exfiltrate entire datasets, corrupt document stores, or gain a foothold for further network attacks. The CVSS score of 9.9 reflects the high impact of bypassing security controls to achieve unauthenticated code execution.

Immediate Action: Update the WeKnora framework to version 0.2.12 immediately to resolve the recursive validation flaw.

Proactive Monitoring: Review PostgreSQL logs for unusual function calls (e.g., lo_import, lo_export) and monitor for anomalous SQL syntax involving complex array expressions.

Compensating Controls: Apply the principle of least privilege to the database user account to limit the impact of a successful SQL injection or RCE.

Public Exploit Available: true

This is a critical vulnerability that bypasses standard SQL injection protections. Immediate patching to version 0.2.12 is the only effective way to ensure the security of the database and the WeKnora application environment.