Description
A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpoint_or_command causes command injection. The attack may be initiated remotely. Patch name: 2b4bf8585c3e731e7a8af30801ea46680bc783f9. To fix this issue, it is recommended to deploy a patch. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Published: 2026-09-20
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: Remote Command Execution via Command Injection
Action: Immediate Patch
AI Analysis

Impact

A flaw in the subprocess.Popen function of backend/aiops/services.py allows an attacker to manipulate the endpoint_or_command argument, leading to execution of arbitrary shell commands. The vulnerability is exploitable remotely, potentially compromising confidentiality, integrity, and availability. The flaw corresponds to CWE-74 and CWE-77 and has a CVSS score of 5.1, indicating a moderate risk level.

Affected Systems

The affected product is aiyiyi121 SxDevOps, version 1.0 and 1.1. The insecure behavior resides in the MCP STDIO Server Management component. A vendor‑supplied patch identified by commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9 is available to remediate the issue.

Risk and Exploitability

The CVSS score of 5.1 suggests moderate severity, but the vulnerability can be triggered from any remote client, implying a non‑restricted attack surface. The EPSS score is not available and the vulnerability is not listed in CISA KEV, yet the lack of exploitation data does not diminish the necessity of patching quickly. Until the patch is applied, an attacker could gain full system control through arbitrary command execution.

Generated by OpenCVE AI on September 20, 2026 at 07:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Roll out the vendor’s security patch identified by commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9 or upgrade to a newer release that incorporates the fix.
  • If immediate patching is not possible, block or restrict external network access to the MCP STDIO Server Management service, limiting connections to known, trusted IP ranges.
  • Implement strict input validation on the endpoint_or_command parameter to allow only whitelisted, pre‑defined commands, effectively preventing arbitrary command execution.

Generated by OpenCVE AI on September 20, 2026 at 07:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 06:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpoint_or_command causes command injection. The attack may be initiated remotely. Patch name: 2b4bf8585c3e731e7a8af30801ea46680bc783f9. To fix this issue, it is recommended to deploy a patch. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Title aiyiyi121 SxDevOps MCP STDIO Server Management services.py subprocess.Popen command injection
First Time appeared Aiyiyi121
Aiyiyi121 sxdevops
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:aiyiyi121:sxdevops:*:*:*:*:*:*:*:*
Vendors & Products Aiyiyi121
Aiyiyi121 sxdevops
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 6.6, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X'}

Subscriptions

Aiyiyi121 Sxdevops
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-20T05:45:10.959Z

Reserved: 2026-09-19T10:14:44.452Z

Link: CVE-2026-93965

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-20T06:16:50.713

Modified: 2026-09-20T06:16:50.713

Link: CVE-2026-93965

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T08:00:08Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')