Live › vulnerability › CVE-2026-117558
Go to dashboardThe ai-sdlc plugin's MCP server passes its repo argument unvalidated into gh issue view and gh pr view commands run through execSync. An attacker who supplies shell metacharacters in that argument, including through a prompt-injected agent, runs arbitrary commands as the MCP server user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Teams running the ai-sdlc plugin's MCP server through version , typically attached to a coding agent that reads untrusted issue or PR content. Exposure comes from the agent passing repo values to the server, so systems without this plugin installed can skip it.
0.31.2No product ranges from the sources yet.
0.31.2 are affected.0.31.2 (fixed version unknown from the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync(), letting prompt-injected agents execute commands as the MCP server user.
This page as .md · .json · in your agent: get_signal("CVE-2026-117558")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.