diff --git a/pkgs/by-name/we/wechat-uos/package.nix b/pkgs/by-name/we/wechat-uos/package.nix
index f6c89f75e50e..2438b13e452d 100644
--- a/pkgs/by-name/we/wechat-uos/package.nix
+++ b/pkgs/by-name/we/wechat-uos/package.nix
@@ -194,6 +194,14 @@ let
           xddxdd
         ];
         mainProgram = "wechat-uos";
+        knownVulnerabilities = [
+          ''
+            CWE-78: Clicking on a file attachment whose name contains backtick-quoted
+            commands will cause it to be executed.
+
+            Reference: https://archive.ph/A5McZ (Chinese)
+          ''
+        ];
       };
     };
 in
diff --git a/pkgs/by-name/we/wechat/package.nix b/pkgs/by-name/we/wechat/package.nix
index 4fe5afe4f9d3..546fda69a0d8 100644
--- a/pkgs/by-name/we/wechat/package.nix
+++ b/pkgs/by-name/we/wechat/package.nix
@@ -23,6 +23,12 @@ let
       "aarch64-linux"
       "x86_64-linux"
     ];
+    knownVulnerabilities = lib.optional stdenvNoCC.hostPlatform.isLinux ''
+      CWE-78: Clicking on a file attachment whose name contains backtick-quoted
+      commands will cause it to be executed.
+
+      Reference: https://archive.ph/A5McZ (Chinese)
+    '';
   };
 
   sources =