Command Injection Vulnerability in SxDevOps by aiyiyi121
CVE-2026-93966

5.1MEDIUM

Key Information:

Vendor

Aiyiyi121

Status
Sxdevops
Vendor
CVE Published:
20 September 2026

What is CVE-2026-93966?

A vulnerability exists in SxDevOps versions 1.0 and 1.1 affecting the paramiko.SSHClient.exec_command function. Malicious manipulation of the command argument allows attackers to execute arbitrary commands remotely, posing serious security risks. It is recommended to apply the provided patch (commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9) to mitigate this issue. The vendor responded swiftly to reports and released a fix promptly.

Affected Version(s)

SxDevOps 1.0

SxDevOps 1.1

References

https://vuldb.com/vuln/407925
vdb-entrytechnical-description
https://vuldb.com/vuln/407925/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-93966
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

_lxf (VulDB User)
VulDB CNA Team
.