PT-2026-95912 · Aiyiyi121 · Sxdevops
CVSS v3.1
6.6
Medium
| Vector | AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
aiyiyi121 SxDevOps versions 1.0 through 1.1
Description
A command injection flaw exists in the MCP STDIO Server Management component within the
subprocess.Popen() function of the backend/aiops/services.py file. A remote attacker can exploit this by manipulating the endpoint or command argument to execute arbitrary commands.Recommendations
Deploy patch 2b4bf8585c3e731e7a8af30801ea46680bc783f9 for versions 1.0 through 1.1.
Exploit
Fix
Command Injection
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Sxdevops