The ai-sdlc plugin MCP server up to version 0.31.2 allows a malicious actor to supply arbitrary shell metacharacters through the unvalidated repo parameter. This value is directly interpolated into the shell commands invoked by execSync(), thereby enabling the execution of arbitrary OS commands as the MCP server user. The weakness is an OS command injection flaw, classified as CWE‑78.

Affected systems include installations of the ai‑sdlc plugin MCP server with version 0.31.2 or earlier. The vulnerability is present in the ai‑sdlc framework’s MCP server component and is tied to the handling of the repo argument in the check‑issue and check‑pr‑status utilities.

The CVSS score of 8.5 reflects a high severity for remote command execution. EPSS information is not available, so the likelihood of exploitation is unclear, and the vulnerability is not listed in the CISA KEV catalog. The attack likely requires the ability to influence the repo argument—such as an authenticated developer or a compromised CI/CD agent—allowing the attacker to inject shell symbols and trigger arbitrary command execution on the server. Once exploited, the attacker gains the privileges of the MCP server process, potentially compromising the entire host and any services running with the same credentials.