Command Injection Vulnerability in SxDevOps MCP STDIO Server Management by aiyiyi121
CVE-2026-93965

5.1MEDIUM

Key Information:

Vendor

Aiyiyi121

Status
Sxdevops
Vendor
CVE Published:
20 September 2026

What is CVE-2026-93965?

A critical flaw exists in the SxDevOps MCP STDIO Server Management component, specifically in the subprocess.Popen function within backend/aiops/services.py. This security issue allows attackers to exploit vulnerable parameters, resulting in command injection attacks that can be triggered remotely. Users are urged to apply the patch provided by the vendor, which addresses this issue promptly and effectively, ensuring better security for the affected versions.

Affected Version(s)

SxDevOps 1.0

SxDevOps 1.1

References

https://vuldb.com/vuln/407924
vdb-entrytechnical-description
https://vuldb.com/vuln/407924/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-93965
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

_lxf (VulDB User)
VulDB CNA Team
.