GitHub Security Advisory: GHSA-8w32-6mrw-q5wv
Package: github.com/Tencent/WeKnora (GO)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 0.2.11
Patched in: 0.2.12

Summary: WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool

Details:
## Summary

A critical Remote Code Execution (RCE) vulnerability exists in the application's database query functionality. The validation system fails to recursively inspect child nodes within PostgreSQL array expressions and row expressions, allowing attackers to bypass SQL injection protections. By smuggling dangerous PostgreSQL functions inside these expressions and chaining them with large object operations and library loading capabilities, an unauthenticated attacker can achieve arbitrary code execution on the database server with database user privileges.

**Impact:** Complete system compromise with arbitrary code execution  
---

## Details

### Root Cause Analysis

The application implements a 7-phase SQL validation framework in `internal/utils/inject.go` designed to prevent SQL injection attacks:

| Phase | Validation Type | Status |
|-------|-----------------|--------|
| Phase 1 | Null byte and length checks | ✅ Working |
| Phase 2 | PostgreSQL AST parsing via `pg_query_go/v6` | ✅ Working |
| Phase 3 | Single statement enforcement | ✅ Working |
| Phase 4 | SELECT-only queries | ✅ Working |
| Phase 5 | Deep SELECT statement validation | ❌ **Incomplete** |
| Phase 6 | Table whitelist validation | ✅ Working |
| Phase 7 | Regex-based keyword detection | ✅ Working |

### Critical Vulnerability: Incomplete AST Node Validation

The `validateNode()` function in Phase 5 fails to handle two critical PostgreSQL expression types: `ArrayExpr` (array expressions) and `RowExpr` (row expressions). This function recursively validates AST nodes to prevent dangerous operations, but lacks handlers for these node types.

**Vulnerable Code Location:** `internal/utils/inject.go` - `validateNode()` function

```go
func (v *sqlValidator) validateNode(node *pg_query.Node, result *SQLValidationResult) error {
	if node == nil {
		return nil
	}

	// Check for subqueries (SubLink)
	if v.checkSubqueries {
		if sl := node.GetSubLink(); sl != nil {
			return fmt.Errorf("subqueries are not allowed")
		}
	}

	// Check for function calls
	if fc := node.GetFuncCall(); fc != nil {
		if err := v.validateFuncCall(fc, result); err != nil {
			return err
		}
	}

	// Check for column references
	if cr := node.GetColumnRef(); cr != nil {
		if err := v.validateColumnRef(cr); err != nil {
			return err
		}
	}

	// Check for type casts
	if tc := node.GetTypeCast(); tc != nil {
		if err := v.validateNode(tc.Arg, result); err != nil {
			return err
		}
		// ... type validation ...
	}
	// ... MISSING: No handler for ArrayExpr or RowExpr ...
}
```

**Missing Handlers:**
- `node.GetArrayExpr()` - Not checked; child elements bypass validation
- `node.GetRowExpr()` - Not checked; child elements bypass validation

### Attack Vector: Smuggling Functions in Array Expressions

By placing dangerous PostgreSQL functions inside array expressions, attackers bypass all validation checks:

```sql
SELECT name, ARRAY[pg_read_file('/etc/passwd'), 'safe-string'] FROM knowledge_bases LIMIT 1
```

**Why T