Description
A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpoint_or_command causes command injection. The attack may be initiated remotely. Patch name: 2b4bf8585c3e731e7a8af30801ea46680bc783f9. To fix this issue, it is recommended to deploy a patch. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Published: 2026-09-20
Score: 5.1 Medium
EPSS: 1.9% Low
KEV: No
Impact: Remote Command Execution via Command Injection
Action: Immediate Patch
AI Analysis

Impact

A flaw in the subprocess.Popen function of backend/aiops/services.py allows an attacker to manipulate the endpoint_or_command argument, leading to execution of arbitrary shell commands. The vulnerability is exploitable remotely, potentially compromising confidentiality, integrity, and availability. The flaw corresponds to CWE-74 and CWE-77 and has a CVSS score of 5.1, indicating a moderate risk level.

Affected Systems

The affected product is aiyiyi121 SxDevOps, version 1.0 and 1.1. The insecure behavior resides in the MCP STDIO Server Management component. A vendor‑supplied patch identified by commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9 is available to remediate the issue.

Risk and Exploitability

The CVSS score of 5.1 suggests moderate severity, but the vulnerability can be triggered from any remote client, implying a non‑restricted attack surface. The EPSS score is 2% and the vulnerability is not listed in CISA KEV, yet the moderate exploitation probability does not diminish the necessity of patching quickly. Until the patch is applied, an attacker could gain full system control through arbitrary command execution.

Generated by OpenCVE AI on September 20, 2026 at 14:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Roll out the vendor’s security patch identified by commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9 or upgrade to a newer release that incorporates the fix.
  • If immediate patching is not possible, block or restrict external network access to the MCP STDIO Server Management service, limiting connections to known, trusted IP ranges.
  • Implement strict input validation on the endpoint_or_command parameter to allow only whitelisted, pre‑defined commands, effectively preventing arbitrary command execution.

Generated by OpenCVE AI on September 20, 2026 at 14:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 20 Sep 2026 06:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpoint_or_command causes command injection. The attack may be initiated remotely. Patch name: 2b4bf8585c3e731e7a8af30801ea46680bc783f9. To fix this issue, it is recommended to deploy a patch. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Title aiyiyi121 SxDevOps MCP STDIO Server Management services.py subprocess.Popen command injection
First Time appeared Aiyiyi121
Aiyiyi121 sxdevops
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:aiyiyi121:sxdevops:*:*:*:*:*:*:*:*
Vendors & Products Aiyiyi121
Aiyiyi121 sxdevops
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 6.6, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X'}

Subscriptions

Aiyiyi121 Sxdevops
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-21T20:08:04.380Z

Reserved: 2026-09-19T10:14:44.452Z

Link: CVE-2026-93965

cve-icon Vulnrichment

Updated: 2026-09-21T20:07:41.139Z

cve-icon NVD

Status : Deferred

Published: 2026-09-20T06:16:50.713

Modified: 2026-09-21T21:17:20.297

Link: CVE-2026-93965

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T10:02:53Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')