PT-2026-95933 · Aiyiyi121 · Sxdevops
CVSS v2.0
5.8
Medium
| Vector | AV:N/AC:L/Au:M/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
aiyiyi121 SxDevOps versions 1.0 through 1.1
Description
Remote command injection is possible within the TASK RUN COMMAND component. The issue exists in the
paramiko.SSHClient.exec command() function located in the backend/ops/host tasks.py file, where improper handling of the command variable allows an attacker to execute arbitrary commands.Recommendations
Apply patch 2b4bf8585c3e731e7a8af30801ea46680bc783f9 for versions 1.0 through 1.1.
Exploit
Fix
Command Injection
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Sxdevops