OS Command Injection Vulnerability in ai-sdlc Plugin by ai-sdlc Framework

CVE-2026-117558

What is CVE-2026-117558?

The ai-sdlc plugin for the MCP server, up to and including version 0.31.2, is susceptible to an OS command injection vulnerability. Attackers can exploit this flaw by injecting shell metacharacters into the unvalidated 'repo' argument, allowing malicious commands to be executed within the context of the MCP server user. This can lead to unauthorized access and control over the server's environment, making it imperative for users to apply the necessary updates and patches provided by the developers.

References